🔑

HTTP Authentication: Basic, Bearer & API Keys

Simple

Free preview · 2 of 5 steps

HTTP authentication: proving identity on every request

HTTP is stateless — every request must carry authentication credentials. The server challenges unauthenticated requests with 401 Unauthorized and a WWW-Authenticate header describing the expected mechanism.

Four main patterns: Basic (credentials in every request), Bearer (token in every request), API key (long-lived token), and mTLS (certificate-based). The right choice depends on the use case: human user, machine-to-machine, or third-party API access.

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step