Authorization
RequestActiveThe Authorization header sends client credentials to authenticate with a server. Most commonly used with Bearer tokens (OAuth 2.0/JWT) for API authentication. The server responds with 401 Unauthorized if credentials are missing or invalid.
Authorization: <auth-scheme> <credentials>
Description
The Authorization request header contains the credentials to authenticate a user agent with a server, usually, but not necessarily, after the server has responded with a 401 Unauthorized status.
Directives
| Directive | Description |
|---|---|
| Bearer <token> | OAuth 2.0 / JWT token authentication. Most common for APIs. |
| Basic <base64> | Base64-encoded username:password. Only use over HTTPS. |
| Digest <params> | MD5-based challenge-response authentication. |
Examples
Bearer token
http
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...Basic auth
http
Authorization: Basic dXNlcjpwYXNzd29yZA==