Skip to main content
NTLM is the challenge-response scheme Windows services use. It is what you reach for against IIS endpoints, on-premise SharePoint and Exchange, and internal APIs joined to an Active Directory domain. Like Digest, NTLM is a conversation rather than a single header. Requestly sends the request, reads the server’s challenge, answers it with a response derived from your password, and replays. All three exchanges travel over the same connection. NTLM applies to HTTP requests. It is not offered for gRPC, and a WebSocket, Socket.IO, or GraphQL request cannot perform the handshake.
NTLM authentication requires the desktop app. Download Requestly.
In the web app NTLM cannot be selected.
NTLM form in the Authorization tab of the desktop app, showing username, password, domain, and workstation fields.NTLM form in the Authorization tab of the desktop app, showing username, password, domain, and workstation fields.

​
Set up NTLM

1

Open the Authorization tab

Open any request or collection in the desktop app, then go to the Authorization tab.
2

Select NTLM

Pick NTLM from the Authorization Type dropdown. The four NTLM fields appear below the dropdown.
3

Enter your domain credentials

Fill in Username and Password, then Domain if your account belongs to one. See the field reference below.
4

Send the request

Click Send. Requestly completes the three-message handshake and returns the authenticated response.

​
Field reference

All four fields accept Requestly variables and vault references.
A domain password unlocks far more than one API. Store it as a vault secret and reference it as {{vault:corp_password}} so it never travels inside an exported collection.

​
Inherit NTLM from a collection

A domain usually fronts many endpoints, so NTLM is a good fit for collection-level auth. Set it once on the collection and leave every request inside on Inherit from parent. Requestly walks up from the request to the nearest ancestor that sets a concrete auth type. A request that picks its own auth type stops inheriting, and a collection or folder whose auth type is cleared or left unset stops the walk for everything below it.

​
Troubleshooting

The web app cannot use NTLM. Open the same project in the desktop app. In the desktop app, NTLM is also unavailable while the execution target is the Cloud Agent, so switch the target back to your own machine.
Check how you split the account name. DOMAIN\jdoe in Username with DOMAIN also in Domain sends the domain twice and fails. Use one or the other.
Requestly signs with NTLMv2. A server configured for Kerberos or SPNEGO only will refuse the handshake. Ask your administrator whether the endpoint accepts NTLM fallback.

​
What’s Next?

Digest Auth

The other challenge-response scheme in the dropdown.

Vault

Keep domain credentials off the collection.

Authorization

Back to every auth type Requestly supports.