> ## Documentation Index
> Fetch the complete documentation index at: https://docs.requestly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# NTLM

> Authenticate against Windows and Active Directory endpoints with NTLM.

NTLM is the challenge-response scheme Windows services use. It is what you reach for against IIS endpoints, on-premise SharePoint and Exchange, and internal APIs joined to an Active Directory domain.

Like Digest, NTLM is a conversation rather than a single header. Requestly sends the request, reads the server's challenge, answers it with a response derived from your password, and replays. All three exchanges travel over the same connection.

NTLM applies to HTTP requests. It is not offered for gRPC, and a WebSocket, Socket.IO, or GraphQL request cannot perform the handshake.

> [!NOTE]
>
> NTLM authentication requires the desktop app. [Download Requestly](https://requestly.com/downloads).

In the web app NTLM cannot be selected.

![NTLM form in the Authorization tab of the desktop app, showing username, password, domain, and workstation fields.](https://mintcdn.com/requestly/eVaYS_FXw1j-9uVi/images/authorization/ntlm-form-desktop.light.png?fit=max\&auto=format\&n=eVaYS_FXw1j-9uVi\&q=85\&s=798bae4dfecdca878ef85f99b72ebdc2)

## Set up NTLM

**1. Open the Authorization tab**

Open any request or collection in the desktop app, then go to the **Authorization** tab.

**2. Select NTLM**

Pick **NTLM** from the **Authorization Type** dropdown. The four NTLM fields appear below the dropdown.

**3. Enter your domain credentials**

Fill in **Username** and **Password**, then **Domain** if your account belongs to one. See the field reference below.

**4. Send the request**

Click **Send**. Requestly completes the three-message handshake and returns the authenticated response.

## Field reference

| Field | Purpose |
| - | - |
| **Username** | Your account name. You can write it bare (`jdoe`) and set **Domain** separately, or use the combined `DOMAIN\jdoe` form and leave **Domain** blank. |
| **Password** | The password for that account. |
| **Domain** | The Active Directory or Windows domain the account belongs to, such as `CORP`. Leave blank for a local machine account. |
| **Workstation** | Optional. The client machine name to report to the server. Most servers ignore it; leave it blank unless your administrator asks for a specific value. |

All four fields accept Requestly [variables](https://docs.requestly.com/api-client/environments-and-variables.md) and [vault](https://docs.requestly.com/api-client/vault/vault.md) references.

> [!WARNING]
>
> A domain password unlocks far more than one API. Store it as a [vault](https://docs.requestly.com/api-client/vault/vault.md) secret and reference it as `{{vault:corp_password}}` so it never travels inside an exported collection.

## Inherit NTLM from a collection

A domain usually fronts many endpoints, so NTLM is a good fit for collection-level auth. Set it once on the collection and leave every request inside on **Inherit from parent**. Requestly walks up from the request to the nearest ancestor that sets a concrete auth type.

A request that picks its own auth type stops inheriting, and a collection or folder whose auth type is cleared or left unset stops the walk for everything below it.

## Troubleshooting

> [accordion] NTLM is missing or unselectable in the dropdown
>
> The web app cannot use NTLM. Open the same project in the [desktop app](https://requestly.com/downloads). In the desktop app, NTLM is also unavailable while the execution target is the Cloud Agent, so switch the target back to your own machine.

> [accordion] The server returns 401 with correct credentials
>
> Check how you split the account name. `DOMAIN\jdoe` in **Username** with `DOMAIN` also in **Domain** sends the domain twice and fails. Use one or the other.

> [accordion] The endpoint expects Kerberos or Negotiate
>
> Requestly signs with NTLMv2. A server configured for Kerberos or SPNEGO only will refuse the handshake. Ask your administrator whether the endpoint accepts NTLM fallback.

## What's Next?

> [card] [Digest Auth](https://docs.requestly.com/api-client/send-api-request/authorization/digest.md)
>
> The other challenge-response scheme in the dropdown.

> [card] [Vault](https://docs.requestly.com/api-client/vault/vault.md)
>
> Keep domain credentials off the collection.

> [card] [Authorization](https://docs.requestly.com/api-client/send-api-request/authorization.md)
>
> Back to every auth type Requestly supports.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.