title: OpenAPI Security Scheme: What is 'type' used for in Cookie auth?
body: <p>OpenAPI allows you to specify various <a href="https://swagger.io/docs/specification/authentication/" rel="nofollow noreferrer">security schemes</a> for authentication and authorization: basic auth, OAuth 2.0, etc. Among them is the simple scheme of having a token or key send in a specific cookie header field: <a href="https://swagger.io/docs/specification/authentication/cookie-authentication/" rel="nofollow noreferrer">Cookie Authentication</a>.</p>
  
  <p>A cookie auth scheme can look like this according to the example on the Swagger page:</p>
  
  <pre><code>components:
    securitySchemes:
      cookieAuth:         # arbitrary name for the security scheme
        type: apiKey
        in: cookie
        name: JSESSIONID  # cookie name
  </code></pre>
  
  <p>I'm wondering about the used <strong>type</strong> attribute. According to the <a href="https://github.com/OAI/OpenAPI-Specification/blob/master/versions/3.0.2.md#securitySchemeObject" rel="nofollow noreferrer">latest OAS 3.0.2 spec</a> the type attribute is</p>
  
  <ul>
  <li>a string</li>
  <li>required</li>
  <li>valid values are <code>apiKey</code>, <code>http</code>, <code>oauth2</code>, <code>openIdConnect</code>.</li>
  </ul>
  
  <p>But can someone actually let me know what these different types actually mean? Is the idea here to just reuse the <code>apiKey</code> type, even if the key/token in question is no an actual API key?</p>