Basic authentication

Basic authentication is the oldest HTTP authentication scheme. The client joins username and password with a colon, Base64-encodes the result and sends it as Authorization: Basic followed by that string. The server decodes it and checks the credentials on every request; there is no token and no session.

How it works

A server that wants credentials answers 401 with a WWW-Authenticate: Basic header, which is what makes a browser show its native login prompt. Because the credentials are on every request, the scheme is only acceptable over HTTPS, and it is still common for internal tools, CI webhooks, package registries and service-to-service calls with dedicated accounts.

The misconception

That Base64 is encryption. It is an encoding anyone can reverse in one line; over plain HTTP, Basic authentication sends the password in the clear. Its security comes entirely from TLS.

Try it here

This playground uses bearer tokens rather than Basic, which makes the contrast easy to see: compare GET /auth/v1/me with qa-admin-token, and decode a Basic header yourself in your browser console with atob().

Related

• What a bearer token is
• HTTP 401 Unauthorized

Other terms

• Mock API — A stand-in for a real API that returns realistic responses without the real system behind it.
• REST API — An API that models a system as addressable resources, manipulated with standard HTTP methods.
• ETag — An opaque version identifier for a representation, used to avoid re-sending it and to detect conflicting writes.
• HATEOAS — Hypermedia as the Engine of Application State — responses carry the links to whatever you can do next.
• Bearer token — A credential where possession alone grants access — whoever holds it can use it.
• JWT (JSON Web Token) — A signed, self-contained token whose payload the server can verify without a database lookup.

All glossary terms · Testing techniques · All 39 mock REST APIs

Last updated 2 October 2026