это видел, но тут для OAuth2
By default, a top-level security that accepts any one of the declared security definitions is generated. For the example above, that would be [{'Basic': []}, {'Bearer': []}]. This can be overriden using the SECURITY_REQUIREMENTS setting.