You can independently enable or disable any of these authentication mechanisms.
When PAPI Web Service starts running, it activates the authentication providers that correspond to the enabled authentication mechanisms.
Every time a client makes a request to PAPI Web Service, this request goes through an authentication phase before reaching the service endpoint. During this phase the activated authentication providers will be called in the order they appear in the preceding list. When one of these providers successfully authenticates the request, the application grants access to the web service. If all the activated providers reject access, the request is rejected.