# Security

To define which security mechanisms should be used for a specific operation, use the @ApiSecurity() decorator.

@ApiSecurity('basic')
@Controller('todo')
export class TodoController {}

Before you run your application, remember to add the security definition to your base document using SpecBuilder:

const options = new Spec().addSecurity('basic', {
  type: 'http',
  scheme: 'basic',
});

Some of the most popular authentication techniques are built-in (e.g., basic and bearer) and therefore you don't have to define security mechanisms manually as shown above.

To enable basic authentication, use @ApiBasicAuth().

@ApiBasicAuth()
@Controller('todo')
export class TodoController {}

Add the security definition to your base document using SpecBuilder:

const options = new SpecBuilder().addBasicAuth();

To enable bearer authentication, use @ApiBearerAuth().

@ApiBearerAuth()
@Controller('todo')
export class TodoController {}

Before you run your application, remember to add the security definition to your base document using SpecBuilder:

const options = new SpecBuilder().addBearerAuth();

To enable OAuth2, use @ApiOAuth2().

@ApiOAuth2(['todos:write'])
@Controller('todo')
export class TodoController {}

Before you run your application, remember to add the security definition to your base document using SpecBuilder:

const options = new SpecBuilder().addOAuth2();

To enable cookie authentication, use @ApiCookieAuth().

@ApiCookieAuth()
@Controller('todo')
export class TodoController {}

Before you run your application, remember to add the security definition to your base document using SpecBuilder:

const options = new SpecBuilder().addCookieAuth('token');