Basic Authentication
Qu'est-ce que Basic Authentication?
Cette entrée n'est actuellement disponible qu'en anglais.
Basic Authentication (Basic auth) is the HTTP authentication scheme defined in RFC 7617: the client sends an Authorization header with the word Basic followed by a base64-encoded username:password pair, and the server validates that pair on every request. Base64 is encoding, not encryption, so the scheme is only safe over TLS, which is why Basic auth shows up in server-to-server API integrations rather than browser logins.
More detail
The header is mechanical to build: join the username, a colon, and the password, base64-encode the result, and prefix it with the word Basic. Every request carries the full credential again, so there is no session, no cookie, and no login redirect — the server simply re-validates the pair each time, which is exactly what makes the scheme a fit for machine-to-machine API traffic no human sits in front of.
Because base64 is reversible encoding rather than encryption, anyone who can read the request can decode the credential — which is why the scheme is only ever carried over TLS, and a Basic auth header sent over plain HTTP is a leaked credential. Production teams treat the pair like any long-lived secret: scope it to one integration, keep it in a secret manager, rotate it on a schedule, and prefer a short-lived, revocable bearer token wherever the receiving API offers one.
On Devotel Orbit, the REST API authenticates with a scoped tenant API key rather than a shared username:password pair, and every webhook delivery carries an HMAC signature your receiver verifies — but Basic auth still appears at the edges of a migration: when you import numbers and messaging configuration from Twilio, the account SID and auth token you paste are the same pair Twilio's own API expects in a Basic auth header.
Questions fréquentes
- Is Basic Authentication secure?
- Only over TLS. The base64 payload decodes with a single function call, so on an unencrypted connection the credential effectively travels in the clear; over HTTPS the transport encryption is what protects it. Treat the scheme as unusable on plain HTTP, and even on HTTPS pair it with credentials that are scoped to one integration and rotated on a schedule.
- What is the difference between Basic and Bearer authentication?
- Basic sends your actual credential pair, re-encoded, on every request; Bearer sends a token the server issued, which can carry a scope and an expiry and can be revoked without anyone changing a password. Both are just header formats — the real difference is whether the value you repeat on every request is the long-lived secret itself or a disposable stand-in for it.
- How do I build a Basic auth header?
- Join the username and password with a colon, base64-encode that string, and prefix the result with the word Basic — for example, the pair Aladdin:open sesame becomes Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==. Most HTTP clients and SDKs build the header for you when you supply a username and password.
See also
Build it on Orbit
Voice, messaging, email, video, and AI agents on one platform and one pay-as-you-go bill. Start free — no credit card required.