Glossary · Phase 8 · APIs
HTTP Basic
Sending a username and password with each request, joined by a colon and base64-encoded, in the Authorization header; safe only over HTTPS.
Try it now
Who is calling, how often, and from where decides the style.
Learn it properly
Authentication and authorization · API keys, sessions, tokens and OAuth: who's calling, and what may they do? About 45 minutes.
Other terms from the same lesson
- authentication: Proving who is making a request, with a key, a password or a token.
- authorization: Deciding what an authenticated caller is allowed to do.
- JWT: A signed token carrying facts about the caller, such as who they are and when the token expires. Signed, not secret.
- OAuth: The standard way to let an app act for you on another service, without giving it your password.
- PKCE: An OAuth safeguard: the app proves it started the login with a secret only it knows, so a stolen code is useless.
Never trained an AI?
Teach a small one to write, right in your browser. It takes about 20 seconds and needs no account.