Home/ Questions/Q 6973431
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-27T17:06:26+00:00

I need to authenticate a client when he sends a request to an API.

  • 0

I need to authenticate a client when he sends a request to an API. The client has an API-token and I was thinking about using the standard Authorization header for sending the token to the server.

Normally this header is used for Basic and Digest authentication. But I don’t know if I’m allowed to customize the value of this header and use a custom authentication scheme, e.g:

Authorization: Token 1af538baa9045a84c0e889f672baf83ff24

Would you recommend this or not? Or is there a better approach for sending the token?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You can create your own custom auth schemas that use the Authorization: header – for example, this is how OAuth works.

    As a general rule, if servers or proxies don’t understand the values of standard headers, they will leave them alone and ignore them. It is creating your own header keys that can often produce unexpected results – many proxies will strip headers with names they don’t recognise.

    Having said that, it is possibly a better idea to use cookies to transmit the token, rather than the Authorization: header, for the simple reason that cookies were explicitly designed to carry custom values, whereas the specification for HTTP’s built in auth methods does not really say either way – if you want to see exactly what it does say, have a look here.

    The other point about this is that many HTTP client libraries have built-in support for Digest and Basic auth but may make life more difficult when trying to set a raw value in the header field, whereas they will all provide easy support for cookies and will allow more or less any value within them.

    • 0