HTTP basic authentication is one of the most popular and straightforward authentication mechanisms available out there. It relies on HTTP headers in the request, which provide the user's credentials. Optionally, the server may reply with a header, forcing the clients to authenticate themselves. The following diagram shows a client-server interaction when basic authentication is carried out:

Whenever an HTTP request is sent to an endpoint secured by HTTP basic authentication, the server replies with an HTTP 401 Unauthorized status code, and, optionally, with a WWW-Authenticate header. This header forces the client to send another request, containing the Authorization header, which specifies that the authentication method is basic. This request is followed by a base64-encoded key/value pair, providing the username and the password to authenticate with. Optionally, the server can specify a message to the client with the realm attribute.

This attribute specifies that resources sharing the same realm value should support the same authentication means. In the preceding diagram, the realm message is MyRealmName. The client authenticates by sending the Authentication header with the value of Basic YWRtaW46YWRtaW4, specifying that Basic authentication is used, followed by the base64-encoded value. In the diagram, the literal YWRtaW46YWRtaW4 decoded in base64 represents the admin:admin literal. In case such a username/password combination is successfully authenticated, the HTTP server will respond with the JSON payload of the requested items. If the authentication fails, the server will respond with the 401 Unauthorized status code, but this time without including the WWW-Authenticate header.