# Synthetic monitoring Authentication
**URL:** https://discuss.elastic.co/t/synthetic-monitoring-authentication/368984
**Category:** Synthetics
**Created:** [October 17, 2024, 9:16am UTC](https://discuss.elastic.co/t/synthetic-monitoring-authentication/368984 "2024-10-17T09:16:44Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@fabry\_00](https://discuss.elastic.co/u/fabry_00)
#### Post date: [October 17, 2024, 9:16am UTC](https://discuss.elastic.co/t/synthetic-monitoring-authentication/368984/1 "2024-10-17T09:16:45Z")
I would like to use synthetic monitoring to monitor out APIs.
Some of these apis are public but some of them are protected by oauth and mtls.
For oauth protected APIs I understood that I can create a 'journey' and use the `request` object to retreive the oauth Token.
But what about mtls? Can I define the client certificate somewhere? and where the client certificate has to be saved?
---
### Author:  [@fabry\_00](https://discuss.elastic.co/u/fabry_00)
#### Post date: [October 17, 2024, 9:38am UTC](https://discuss.elastic.co/t/synthetic-monitoring-authentication/368984/2 "2024-10-17T09:38:05Z")
I actually found that you can setup the ssl certficates:
[HTTP options | Heartbeat Reference [8.15] | Elastic](https://www.elastic.co/guide/en/beats/heartbeat/8.15/monitor-http-options.html)
What about oatuh? is there a way to have an oauth protected API ping test with a lightwaight monitor? or Should I use the journey ?
---
### Author:  [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)
#### Post date: [October 17, 2024, 12:53pm UTC](https://discuss.elastic.co/t/synthetic-monitoring-authentication/368984/3 "2024-10-17T12:53:59Z")
Hi @fabry_00,
I'm not aware of a way to handle OAuth token-based pings in a Lightweight monitor. It is possible with a journey using a [similar approach covered in this post](https://discuss.elastic.co/t/dec-8th-2023-en-authentication-in-synthetic-monitoring-with-playwright-and-elastic-synthetics/347290).
Hope that helps!