---
title: "(Optional) Add authentication to your spike script | Grafana Labs"
description: "Pass API tokens or bearer credentials from environment variables into k6 HTTP calls so spike tests match how protected production routes are exercised."
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

# (Optional) Add authentication to your spike script

> Note
> 
> This milestone is optional. The QuickPizza home page doesn’t require a token, but its API routes (such as /api/pizza) require a demo token, such as `Token abcdef0123456789`, and return `401` without it. For realistic practice with your own credentials, point the URLs and environment variables at your own staging API that expects a bearer token or API key, so a missing or invalid token makes your `check()` assertions fail loudly.

Spike tests are only realistic when they hit the same code paths as production. Protected routes often add token validation, caching, and rate limits that an unauthenticated script never exercises. The standard k6 pattern is to read secrets from the **environment**, never hard-code them in the script.

To add authentication to your spike requests, complete the following steps:

1. Choose an environment variable name for the credential, for example `SPIKE_API_TOKEN`. Do not commit real tokens to Git; set the variable only in your shell session, CI secret store, or Grafana Cloud k6 test secrets when you run for real.
2. At the top of your script (below imports), read the token once. Keep your existing `export const options` block unchanged immediately after:
   
   JavaScript ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy
   
   ```javascript
   import http from 'k6/http';
   import { check, sleep } from 'k6';
   
   const token = __ENV.SPIKE_API_TOKEN || '';
   
   export const options = {
     stages: [
       /* … your existing stages … */
     ],
     thresholds: {
       /* … your existing thresholds … */
     },
   };
   ```
   
   Copy your real `stages` and `thresholds` from `spike.js` or `spike-multi.js` in place of the comments.
3. Add a small helper so every request can attach the same headers when a token is present:
   
   JavaScript ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy
   
   ```javascript
   function authHeaders() {
     if (!token) {
       return {};
     }
     return {
       headers: {
         Authorization: `Bearer ${token}`,
       },
     };
   }
   ```
4. Merge those headers into each request. For a GET with URL grouping and tags:
   
   JavaScript ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy
   
   ```javascript
   const res = http.get(http.url`https://your-api.example.com/api/status`, {
     ...authHeaders(),
     tags: { name: 'GET_status' },
   });
   ```
   
   For POST requests, merge `authHeaders().headers` into your existing `headers` object (for example keep `Content-Type: application/json` and add `Authorization` in the same object).
5. Run the script with the variable set for one local check:
   
   Bash ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy
   
   ```bash
   SPIKE_API_TOKEN=your-staging-token k6 run spike.js
   ```
   
   Confirm that status checks match what your API returns for valid credentials (`200`/`204`) versus missing or invalid tokens (`401`/`403`).

Open **Turn spike results into action** in the sidebar to plan follow-up work.