Can I monitor authenticated sites?
Yes. Every uptime check supports custom headers and payloads, so you can send cookies, bearer tokens, HTTP Basic authentication, or any other credentials your endpoint requires.
Common patterns we see:
- HTTP Basic auth: add an
Authorization: Basic ...header - Bearer tokens: add
Authorization: Bearer <token> - Custom API keys: add your service's specific header (
X-Api-Key: ...,X-Auth-Token: ...) - Session cookies: paste the
Cookieheader value
If you're protecting a site with HTTP Basic auth, our guide "How to monitor websites behind HTTP basic authentication" walks through the setup in detail.
Rotating credentials regularly is a good idea (for everyone, not just us). When you rotate, update the monitor's custom headers so your uptime checks keep passing.
