Not a valid securityDefinitions definition - swagger for Auth0

Question

I have the following spec.yaml file

swagger: '2.0'
info:
  title: Store API
  version: "0.3.5"
host: SELF_URL_REPLACED_BY_APP
schemes:
  - https
basePath: /
produces:
  - application/json
tags:
  - name: account
  - name: transcripts
security:
  - auth0:
    - openid
  - apiKey: []
securityDefinitions:
  auth0:
    type: oauth2
    authorizationUrl: https://store.auth0.com/authorize
    flow: implicit
    tokenName: id_token
    scopes:
      openid: Grant access to user
  apiKey:
    type: apiKey
    name: Authorization
    in: header

I get this error when i try to validate it in http://editor.swagger.io/ :

✖ Swagger Error
Not a valid securityDefinitions definition
Jump to line 19
Details
 Object
code:  "ONE_OF_MISSING"
 params: Array [0]
message:  "Not a valid securityDefinitions definition"
 path: Array [2]
schemaId:  "http://swagger.io/v2/schema.json#"
 inner: Array [6]
level: 900
type:  "Swagger Error"
description:  "Not a valid securityDefinitions definition"
lineNumber: 19

What am I missing? I am able to login using Auth0 and everything seems to work fine.

Any advice is much appreciated.

Answer 1

tokenName is not a valid property of the SecurityDefinitions object.

However your Swagger definition has other errors - such as no paths - which may cause it to give incorrect validation errors about securityDefinitions as you're editing.

The following for instance should validate fine:

swagger: '2.0'
info:
  title: Store API
  version: "0.3.5"
host: SELF_URL_REPLACED_BY_APP
schemes:
  - https
basePath: /
produces:
  - application/json
tags:
  - name: account
  - name: transcripts
paths:
  /pets:
    get:
      description: Returns all pets from the system that the user has access to
      produces:
      - application/json
      responses:
        '200':
          description: A list of pets.
          schema:
            type: array
            items:
              type: string
      security:
        - auth0: 
          - openid
        - apiKey: []
securityDefinitions:
  auth0:
    type: oauth2
    authorizationUrl: https://store.auth0.com/authorize
    flow: implicit
    scopes:
      openid: Grant access to user
  apiKey:
    type: apiKey
    name: Authorization
    in: header

Also the security section does not belong at the top level, but should be placed under each API method (see above definition for an example) to specify which security definitions should be applied to that API.