Introduction

When securing Spring Boot APIs with JWT, Swagger UI needs authorization configuration so requests sent from docs include bearer tokens automatically. Without this setup, endpoints appear “broken” in UI despite working with curl/Postman.

This article shows OpenAPI configuration for JWT bearer auth in Swagger UI.

Core Sections

1) Define security scheme

1@Bean
2public OpenAPI api() {
3    return new OpenAPI()
4        .components(new Components().addSecuritySchemes("bearerAuth",
5            new SecurityScheme()
6                .type(SecurityScheme.Type.HTTP)
7                .scheme("bearer")
8                .bearerFormat("JWT")))
9        .addSecurityItem(new SecurityRequirement().addList("bearerAuth"));
10}

2) Annotate endpoints if needed

@SecurityRequirement(name = "bearerAuth")
@RestController
class UserController {}

Apply globally or per-controller/endpoint.

3) Swagger UI usage

Click Authorize, paste raw JWT token (without Bearer prefix in many UIs), then execute secured endpoints.

4) Spring Security filter compatibility

Ensure auth filter reads Authorization: Bearer <token> header and does not block /swagger-ui/** and /v3/api-docs/**.

5) Environment-specific concerns

In dev, allow docs endpoints; in production, consider restricting docs access or disabling UI.

6) Production checklist for API documentation security setup

A correct code snippet is only the baseline. To make this approach durable in production, define explicit acceptance checks around correctness, reliability, and operational behavior. Correctness means the output should match known-good fixtures for both normal and edge-case inputs. Reliability means failures are predictable and observable, with clear error messages and no silent degradation paths. Operational behavior means the implementation performs within expected latency and resource usage under realistic load, not only under tiny test data. Teams that skip this validation layer often ship logic that appears correct in local testing but fails under real traffic or environmental differences.

Document assumptions near the implementation: runtime version, dependency versions, required environment variables, and external system expectations. Many regressions are caused by version drift or configuration changes, not by algorithmic mistakes. If this workflow depends on filesystem paths, network resources, security credentials, or framework defaults, codify those requirements in code comments or adjacent documentation so they are visible during review. Add one deterministic smoke test that executes this path end-to-end and one failure-mode test that proves errors are surfaced with enough context for quick triage.

A practical release sequence is:

1. Run static checks and unit tests in CI.
2. Execute a smoke test with representative input shape and size.
3. Trigger one expected failure mode and verify logs/metrics.
4. Deploy with staged rollout or feature flag where possible.
5. Monitor stabilization metrics before broad rollout.

1# Example delivery workflow
2make lint
3make test
4./scripts/smoke_check.sh

Ownership and rollback should also be explicit. Define who responds when this component fails, what thresholds trigger rollback, and which fallback behavior is acceptable for users. If the workflow is business-critical, keep a concise runbook that includes common failure signatures and first-response steps. This reduces mean time to recovery and prevents repeated rediscovery of the same diagnostics.

Finally, maintain a brief limitations note. State what this approach intentionally does not solve and where alternative patterns are preferred. This prevents accidental overuse and keeps architecture decisions grounded in explicit tradeoffs. Revisit this checklist after framework, runtime, or infrastructure upgrades because previously safe assumptions can change when defaults evolve.

Common Pitfalls

• Defining scheme but not applying security requirement.
• Including wrong token format in authorize dialog.
• Blocking Swagger endpoints via security config.
• Mixing deprecated springfox config with springdoc-openapi config.
• Forgetting CORS settings when Swagger UI served from different origin.

Summary

To set JWT token in Swagger UI for Spring Boot, configure bearer security scheme and ensure security filters allow docs endpoints. With proper OpenAPI wiring, interactive testing of protected APIs becomes straightforward.

For long-term stability, keep one regression test and one smoke-check script tied to this workflow in CI, and re-run both after runtime or dependency upgrades. Document expected environment assumptions and known limits in the repository so responders can troubleshoot quickly without re-deriving baseline behavior during incidents.