With the introduction of Bearer Authentication tokens in version 5.0 (June 2022), the older Digest Authentication method was officially deprecated.

Deprecation means that a feature is marked for removal: while it may still work, it is no longer recommended, or guaranteed to function in future versions.

For Digest Authentication, this means:

• It is outdated and will no longer receive active development.
• It will be disabled in upcoming releases.
• Users should transition to the newer, more secure alternatives.

We understand this update may raise some concerns, but rest assured the actual impact is smaller than it may seem. This article is here to walk you through what’s changing and the recommended steps to stay fully prepared. And remember, if you have any questions along the way, please contact your local Authorized Reseller or System Integrator to resolve these questions.

How Does This Affect Me?

Standard Security Level

• In version 6.1, Digest Authentication is still available if your system is set to the Standard security level for local user accounts.
• In version 6.1, Digest Authentication is removed if your system is set to the Standard security level for cloud user accounts.
• Local User accounts can still be created with Digest Authentication, both in upgraded systems and in new installations.
• If you create a Digest user in version 6.1, you will see a warning (similar to version 6.0) stating that Digest Authentication will be disabled in the next major version.

High Security Level

• In version 6.1, Digest Authentication is disabled if your system is set to the High security level for local user accounts.
• In version 6.1, Digest Authentication is removed if your system is set to the High security level for cloud user accounts.
• Existing users configured with Digest Authentication will no longer be able to log in or authenticate API requests.
• Emergency option: A fallback is available for version 6.1 if Digest Authentication is absolutely required. Contact your Authorized Reseller or System Integrator for assistance.

Recommended Actions

Even though most users have already been using Bearer Authentication by default since its introduction, system administrators should take the following steps:

1. Review User Accounts
   • Check whether any users are still configured with Digest Authentication.
   • Transition them to Bearer Authentication wherever possible.
      
2. Review Rules and Events
   • Generic Events: Some rules may use a Digest-authenticated account. Update these to use Bearer Authentication or one-time ticket tokens.
      
3. Update Actions
   • The older action Do HTTP(S) request requires Digest Authentication, although Bearer Authentication was added for 3rd party integrations. This can’t be used within the VMS, since the tokens need to be refreshed before they become void.
   • Switch to the new Site HTTPS request action introduced in version 6.1.
     • This action is designed for API requests within the same Site.
     • It uses token-based authentication instead of Digest.

Bearer Authentication and One-time ticket tokens

Token based authentication provides stronger security and greater flexibility:

• Bearer tokens (Login Session): For ongoing authentication.
• Basic Authorization Header: For integrations unable to use a bearer token.
• One-time ticket tokens (Authorization ticket): For temporary or single-use authentication.

For details, refer to the API Documentation under the Login section.

Custom Integrations

Digest Authentication deprecation was announced in the 5.0 Changelog (June 2022) to give integrators time to update.

If you rely on custom integrations, plugins, or third-party tools:

• Contact the integration developer to confirm that they have migrated to a compatible REST API version.
• Ensure that Token Authentication (Bearer or Basic Authorization headers) or ticket-based authentication is implemented.
• Verify compatibility with the VMS version you are running.

This ensures your system remains secure and future-proof.

Need Help?

We understand this transition may raise questions. For guidance or assistance:

• Contact your Authorized Reseller or your System Ingrator.
• Review the API documentation for technical details on Bearer Authentication and ticket tokens.