HTTP Basic Authentication — Complete API Auth Guide

In this tutorial, you will learn about HTTP Basic Authentication. We cover key concepts, practical examples, and best practices to help you master this topic.

HTTP Basic Authentication sends credentials as a base64-encoded username:password string in the Authorization header. It is the simplest authentication mechanism defined by the HTTP specification.

What You'll Learn

You'll learn how Basic Auth works, its security implications, and when it is acceptable to use.

Why It Matters

Basic Auth is universally supported by HTTP clients and servers. Despite its simplicity, it remains useful for internal tools, testing, and legacy integrations.

Real-World Use

An internal deployment script authenticates to a CI/CD API using Basic Auth over HTTPS. The credentials are stored in the CI/CD tool's secrets manager, not in the script itself.

sequenceDiagram
    participant Client
    participant API
    Client->>API: GET /resource
    API->>Client: 401 Unauthorized (WWW-Authenticate: Basic)
    Client->>Client: Encode username:password as base64
    Client->>API: GET /resource (Authorization: Basic base64)
    API->>Client: 200 OK (Resource)

Implementation

from flask import Flask, request, jsonify
from functools import wraps

app = Flask(__name__)

USERS = {
    "admin": "password123",
    "api-user": "secret456"
}

def require_basic_auth(f):
    @wraps(f)
    def decorated(*args, **kwargs):
        auth = request.authorization
        if not auth or not auth.username or not auth.password:
            return jsonify({"error": "Unauthorized"}), 401
        if USERS.get(auth.username) != auth.password:
            return jsonify({"error": "Invalid credentials"}), 401
        return f(*args, **kwargs)
    return decorated

@app.route("/api/data")
@require_basic_auth
def get_data():
    return jsonify({"message": "Authenticated with Basic Auth", "user": request.authorization.username})

Common Mistakes

What's Next

Learn about multi-factor authentication for enhanced security.