Extracted from https://github.com/swagger-api/swagger-ui/issues/1244, i.e.

• https://github.com/swagger-api/swagger-ui/issues/1244#issuecomment-245638234

For those who land here, like me, looking for more information, the missing piece for me was the matching name for the securityDefinitions, security and the JS code use of the same name. For example, here is some swagger spec JSON to specify global API token access:

    "securityDefinitions": {
      "my_token": {
        "type": "apiKey",
        "description": "Authorization Token",
        "name": "my_token",
        "in": "header"
      }
    },
    "security": [
      { "my_token": [] }
    ],

Given that API spec, the JS code to match must use the same name, i.e. "my_token", as in:

var tokenAuth = new SwaggerClient.ApiKeyAuthorization("Authorization", "Token " + token, "header");
window.swaggerUi.api.clientAuthorizations.add("my_token", tokenAuth);

The name of the securityDefinitions is arbitrary and crucial. Most of the examples use "api_key", but you might want something else. The string "api_key" is just a name, it's not a reserved identifier with special meaning for swagger-ui, it's arbitrary (AFAICT).