Use Basic authentication

HTTP Basic authentication is the oldest and simplest auth scheme on the web. The client sends a username and password in an Authorization header with every request. The pair is joined with a colon and Base64-encoded.

Encoded, not encrypted. Base64 is trivially reversible, so the scheme itself protects nothing. HTTPS has to protect the connection, or you’re broadcasting a password.

You still meet Basic auth all the time. Staging sites behind a shared password. Internal dashboards. Webhooks. Plenty of APIs that use it with a token as the username and an empty password.

Authenticate a request

Use a disposable lab credential against an endpoint built for practice:

curl --user 'student:practice-only' https://httpbin.org/basic-auth/student/practice-only

A matching credential returns success:

{
  "authenticated": true,
  "user": "student"
}

Now change the password and run it again. The server answers 401 Unauthorized, and curl prints nothing useful. Add --write-out '%{response_code}\n' to see the status, or --fail to turn the 401 into exit code 22 that a script can act on.

Here’s what curl did. It took student:practice-only, Base64-encoded it to c3R1ZGVudDpwcmFjdGljZS1vbmx5, and sent Authorization: Basic c3R1ZGVudDpwcmFjdGljZS1vbmx5. Decode it yourself:

echo 'c3R1ZGVudDpwcmFjdGljZS1vbmx5' | base64 -d

The password stares back at you. That’s why the HTTPS requirement is absolute.

Add -v only in a private terminal. Verbose output prints the Authorization header as sent.

Keep the password out of history

The command above stores the password in your shell history. For real credentials, give --user only the username and let curl ask:

curl --user student https://httpbin.org/basic-auth/student/practice-only

curl prompts with Enter host password for user 'student':. The password never touches history, process listings, or your screen.

Avoid the other tempting shortcut too: credentials embedded in the URL, like https://student:practice-only@httpbin.org/.... URLs end up in logs, browser history, and pasted messages. A URL-shaped secret gets copied around without anyone noticing there’s a password in it.

My hierarchy

For interactive use, let curl prompt. For automation, read the credential from a protected config file or a secret manager. Never type a real credential inline in a shared terminal, and never commit one to a script.

Try the prompt version now with the lab credential. Then run history | tail -3 and confirm the password is not there.