Authorization header - HTTP | MDN

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Authorization • 216 KB fetched
Open original page

Authorization header - HTTP | MDN

*
Skip to main content

*
Skip to search

HTML

HTML: Markup language

HTML reference

*
Elements

*
Global attributes

*
Attributes

*
See all…

HTML guides

*
Responsive images

*
HTML cheatsheet

*
Date & time formats

*
See all…

Markup languages

*
SVG

*
MathML

*
XML

CSS

CSS: Styling language

CSS reference

*
Properties

*
Selectors

*
At-rules

*
Values

*
See all…

CSS guides

*
Box model

*
Animations

*
Flexbox

*
Colors

*
See all…

Layout cookbook

*
Column layouts

*
Centering an element

*
Card component

*
See all…

JavaScript JS

JavaScript: Scripting language

JS reference

*
Standard built-in objects

*
Expressions & operators

*
Statements & declarations

*
Functions

*
See all…

JS guides

*
Control flow & error handing

*
Loops and iteration

*
Working with objects

*
Using classes

*
See all…

Web APIs

Web APIs: Programming interfaces

Web API reference

*
File system API

*
Fetch API

*
Geolocation API

*
HTML DOM API

*
Push API

*
Service worker API

*
See all…

Web API guides

*
Using the Web animation API

*
Using the Fetch API

*
Working with the History API

*
Using the Web speech API

*
Using web workers

All

All web technology

Technologies

*
Accessibility

*
HTTP

*
URI

*
Web extensions

*
WebAssembly

*
WebDriver

*
See all…

Topics

*
Media

*
Performance

*
Privacy

*
Security

*
Progressive web apps

Learn

Learn web development

Frontend developer course

*
Getting started modules

*
Core modules

*
MDN Curriculum

*
Check out the video course from Scrimba, our partner

Learn HTML

*
Structuring content with HTML module

Learn CSS

*
CSS styling basics module

*
CSS layout module

Learn JavaScript

*
Dynamic scripting with JavaScript module

Tools

Discover our tools

*
Playground

*
HTTP Observatory

*
Border-image generator

*
Border-radius generator

*
Box-shadow generator

*
Color format converter

*
Color mixer

*
Shape generator

About

Get to know MDN better

*
About MDN

*
Advertise with us

*
Community

*
MDN on GitHub

Blog

Toggle sidebar

*
Web

*
HTTP

*
Reference

*
Headers

*
Authorization

Theme

*

OS default

*

Light

*

Dark

English (US)

Remember language
Learn more

*
Deutsch

*
English (US)

*
Español

*
Français

*
日本語

*
한국어

*
Português (do Brasil)

*
Русский

*
中文 (简体)

*
正體中文 (繁體)

Authorization header

Baseline

Widely available

*

This feature is well established and works across many devices and browser versions. It’s been available across browsers since July 2015.

* Some parts of this feature may have varying levels of support.

*

See full compatibility

*

Learn more

The HTTP Authorization request header can be used to provide credentials that authenticate a user agent with a server, allowing access to protected resources.

The Authorization header is usually, but not always, sent after the user agent first attempts to request a protected resource without credentials.
The server responds with a 401 Unauthorized message that includes at least one WWW-Authenticate header.
This header indicates the authentication schemes that can be used to access the resource and any additional information needed by the client to use them.
The user-agent should select the most secure authentication scheme that it supports from those offered, prompt the user for their credentials, and then re-request the resource with the encoded credentials in the Authorization header.

This header is stripped from cross-origin redirects.

Note:
This header is part of the General HTTP authentication framework .
It can be used with a number of authentication schemes .

Header type
Request header

Forbidden request header
No

In this article

*
Syntax

*
Directives

*
Examples

*
Specifications

*
Browser compatibility

*
See also

Syntax

http
Authorization: <auth-scheme> <authorization-parameters>

// Basic authentication
Authorization: Basic <credentials>

// Digest authentication
Authorization: Digest username=<username>,
realm="<realm>",
uri="<url>",
algorithm=<algorithm>,
nonce="<nonce>",
nc=<nc>,
cnonce="<cnonce>",
qop=<qop>,
response="<response>",
opaque="<opaque>"

Directives

<auth-scheme>

The Authentication scheme that defines how the credentials are encoded.
Some of the more common types are (case-insensitive): Basic , Digest , Negotiate and AWS4-HMAC-SHA256 .

Note:
For more information/options see HTTP Authentication > Authentication schemes

Other than <auth-scheme> , the remaining directives are specific to each authentication scheme .
Generally, you will need to check the relevant specifications for these (keys for a small subset of schemes are listed below).

Basic authentication

<credentials>

The credentials, encoded according to the specified scheme.

Note:
For information about the encoding algorithm, see the examples: below, in WWW-Authenticate , in HTTP Authentication , and in the relevant specifications.

Digest authentication

<response>

A string of the hex digits that proves that the user knows a password.
The algorithm encodes the username and password, realm, cnonce, qop, nc, and so on.
It is described in detail in the specification.

username

A quoted string containing user's name for the specified realm in either plain text or the hash code in hexadecimal notation.
If the name contains characters that aren't allowed in the field, then username* can be used instead (not "as well").

username*

The user's name formatted using an extended notation defined in RFC5987.
This should be used only if the name can't be encoded in username and if userhash is set "false" .

uri

The Effective Request URI . See the specification for more information.

realm

Realm of the requested username/password (again, should match the value in the corresponding WWW-Authenticate response for the resource being requested).

opaque

The value in the corresponding WWW-Authenticate response for the resource being requested.

algorithm

The algorithm used to calculate the digest. Must be a supported algorithm from the WWW-Authenticate response for the resource being requested.

qop

A token indicating the quality of protection applied to the message.
Must match the one value in the set specified in the WWW-Authenticate response for the resource being requested.

* "auth" : Authentication

* "auth-int" : Authentication with integrity protection

cnonce

A quoted ASCII -only string value provided by the client.
This is used by both the client and server to provide mutual authentication, provide some message integrity protection, and avoid "chosen plaintext
attacks".
See the specification for additional information.

nc

Nonce count. The hexadecimal count of requests in which the client has sent the current cnonce value (including the current request).
The server can use duplicate nc values to recognize replay requests.

userhash Optional

"true" if the username has been hashed. "false" by default.

Examples

Basic authentication

For Basic authentication, the credentials are constructed by first combining the username and the password with a colon (e.g., aladdin:opensesame ), and then by encoding the resulting string in base64 (e.g., YWxhZGRpbjpvcGVuc2VzYW1l ).

http
Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l

Warning:
Base64 -encoding can easily be reversed to obtain the original name and password, so Basic authentication offers no cryptographic security.
HTTPS is always recommended when using authentication, but is even more so when using Basic authentication.

See also HTTP authentication for examples on how to configure Apache or Nginx servers to password protect your site with HTTP basic authentication.

Specifications

Specification

HTTP Semantics
# field.authorization

Browser compatibility

See also

* HTTP authentication

* WWW-Authenticate

* Proxy-Authorization

* Proxy-Authenticate

* 401 , 403 , 407

Help improve MDN

Yes

No

Learn how to contribute
This page was last modified on Oct 30, 2025 by MDN contributors .

View this page on GitHub • Report a problem with this content

Clear filter input

* HTTP

* Guides

* Overview of HTTP

* Evolution of HTTP

* A typical HTTP session

* HTTP messages

* Media types
* Common types

* Compression in HTTP

* HTTP caching

* HTTP authentication

* Using HTTP cookies

* Redirections in HTTP

* Conditional requests

* Range requests

* Client hints

* User-Agent reduction

* Compression Dictionary Transport

* Network Error Logging

* Content negotiation
* Default Accept values

* Browser detection using the UA string

* Connection management in HTTP/1.x

* Protocol upgrade mechanism

* Proxy servers and tunneling
* Proxy Auto-Configuration (PAC) file

* Security and privacy
* HTTP Observatory

* Practical implementation guides

* Permissions Policy

* Cross-Origin Resource Policy (CORP)

* IFrame credentialless

* Fetch metadata

* Cross-Origin Resource Sharing (CORS)

* CORS errors
* Reason: CORS disabled

* Reason: CORS header 'Access-Control-Allow-Origin' does not match 'xyz'

* Reason: CORS header 'Access-Control-Allow-Origin' missing

* Reason: CORS header 'Origin' cannot be added

* Reason: CORS preflight channel did not succeed

* Reason: CORS request did not succeed

* Reason: CORS request external redirect not allowed

* Reason: CORS request not HTTP

* Reason: Credential is not supported if the CORS header 'Access-Control-Allow-Origin' is '*'

* Reason: Did not find method in CORS header 'Access-Control-Allow-Methods'

* Reason: expected 'true' in CORS header 'Access-Control-Allow-Credentials'

* Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Headers'

* Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Methods'

* Reason: missing token 'xyz' in CORS header 'Access-Control-Allow-Headers' from CORS preflight channel

* Reason: Multiple CORS header 'Access-Control-Allow-Origin' not allowed

* Content Security Policy (CSP)
* Errors and warnings

* Reference

* HTTP headers
* Accept

* Accept-CH

* Accept-Encoding

* Accept-Language

* Accept-Patch

* Accept-Post

* Accept-Ranges

* Access-Control-Allow-Credentials

* Access-Control-Allow-Headers

* Access-Control-Allow-Methods

* Access-Control-Allow-Origin

* Access-Control-Expose-Headers

* Access-Control-Max-Age

* Access-Control-Request-Headers

* Access-Control-Request-Method

* Activate-Storage-Access

* Age

* Allow

* Alt-Svc

* Alt-Used

* Attribution-Reporting-Eligible

* Attribution-Reporting-Register-Source

* Attribution-Reporting-Register-Trigger

* Authorization

* Available-Dictionary

* Cache-Control

* Clear-Site-Data

* Connection

* Content-Digest

* Content-Disposition

* Content-DPR

* Content-Encoding

* Content-Language

* Content-Length

* Content-Location

* Content-Range

* Content-Security-Policy

* Content-Security-Policy-Report-Only

* Content-Type

* Cookie

* Critical-CH

* Cross-Origin-Embedder-Policy

* Cross-Origin-Embedder-Policy-Report-Only

* Cross-Origin-Opener-Policy

* Cross-Origin-Resource-Policy

* Date

* Device-Memory

* Dictionary-ID

* DNT

* Downlink

* DPR

* Early-Data

* ECT

* ETag

* Expect

* Expect-CT

* Expires

* Forwarded

* From

* Host

* Idempotency-Key

* If-Match

* If-Modified-Since

* If-None-Match

* If-Range

* If-Unmodified-Since

* Integrity-Policy

* Integrity-Policy-Report-Only

* Keep-Alive

* Last-Modified

* Link

* Location

* Max-Forwards

* NEL

* No-Vary-Search

* Observe-Browsing-Topics

* Origin

* Origin-Agent-Cluster

* Permissions-Policy

* Permissions-Policy-Report-Only

* Pragma

* Prefer

* Preference-Applied

* Priority

* Proxy-Authenticate

* Proxy-Authorization

* Range

* Referer

* Referrer-Policy

* Refresh

* Report-To

* Reporting-Endpoints

* Repr-Digest

* Retry-After

* RTT

* Save-Data

* Sec-Browsing-Topics

* Sec-CH-Device-Memory

* Sec-CH-DPR

* Sec-CH-Prefers-Color-Scheme

* Sec-CH-Prefers-Reduced-Motion

* Sec-CH-Prefers-Reduced-Transparency

* Sec-CH-UA

* Sec-CH-UA-Arch

* Sec-CH-UA-Bitness

* Sec-CH-UA-Form-Factors

* Sec-CH-UA-Full-Version

* Sec-CH-UA-Full-Version-List

* Sec-CH-UA-Mobile

* Sec-CH-UA-Model

* Sec-CH-UA-Platform

* Sec-CH-UA-Platform-Version

* Sec-CH-UA-WoW64

* Sec-CH-Viewport-Height

* Sec-CH-Viewport-Width

* Sec-CH-Width

* Sec-Fetch-Dest

* Sec-Fetch-Mode

* Sec-Fetch-Site

* Sec-Fetch-Storage-Access

* Sec-Fetch-User

* Sec-GPC

* Sec-Private-State-Token

* Sec-Private-State-Token-Crypto-Version

* Sec-Private-State-Token-Lifetime

* Sec-Purpose

* Sec-Redemption-Record

* Sec-Speculation-Tags

* Sec-WebSocket-Accept

* Sec-WebSocket-Extensions

* Sec-WebSocket-Key

* Sec-WebSocket-Protocol

* Sec-WebSocket-Version

* Server

* Server-Timing

* Service-Worker

* Service-Worker-Allowed

* Service-Worker-Navigation-Preload

* Set-Cookie

* Set-Login

* SourceMap

* Speculation-Rules

* Strict-Transport-Security

* Supports-Loading-Mode

* TE

* Timing-Allow-Origin

* Tk

* Trailer

* Transfer-Encoding

* Upgrade

* Upgrade-Insecure-Requests

* Use-As-Dictionary

* User-Agent

* Vary

* Via

* Viewport-Width

* Want-Content-Digest

* Want-Repr-Digest

* Warning

* Width

* WWW-Authenticate

* X-Content-Type-Options

* X-DNS-Prefetch-Control

* X-Forwarded-For

* X-Forwarded-Host

* X-Forwarded-Proto

* X-Frame-Options

* X-Permitted-Cross-Domain-Policies

* X-Powered-By

* X-Robots-Tag

* X-XSS-Protection

* HTTP request methods
* CONNECT

* DELETE

* GET

* HEAD

* OPTIONS

* PATCH

* POST

* PUT

* TRACE

* HTTP response status codes
* 100 Continue

* 101 Switching Protocols

* 103 Early Hints

* 200 OK

* 201 Created

* 202 Accepted

* 203 Non-Authoritative Information

* 204 No Content

* 205 Reset Content

* 206 Partial Content

* 207 Multi-Status

* 208 Already Reported

* 226 IM Used

* 300 Multiple Choices

* 301 Moved Permanently

* 302 Found

* 303 See Other

* 304 Not Modified

* 307 Temporary Redirect

* 308 Permanent Redirect

* 400 Bad Request

* 401 Unauthorized

* 402 Payment Required

* 403 Forbidden

* 404 Not Found

* 405 Method Not Allowed

* 406 Not Acceptable

* 407 Proxy Authentication Required

* 408 Request Timeout

* 409 Conflict

* 410 Gone

* 411 Length Required

* 412 Precondition Failed

* 413 Content Too Large

* 414 URI Too Long

* 415 Unsupported Media Type

* 416 Range Not Satisfiable

* 417 Expectation Failed

* 418 I'm a teapot

* 421 Misdirected Request

* 422 Unprocessable Content

* 423 Locked

* 424 Failed Dependency

* 425 Too Early

* 426 Upgrade Required

* 428 Precondition Required

* 429 Too Many Requests

* 431 Request Header Fields Too Large

* 451 Unavailable For Legal Reasons

* 500 Internal Server Error

* 501 Not Implemented

* 502 Bad Gateway

* 503 Service Unavailable

* 504 Gateway Timeout

* 505 HTTP Version Not Supported

* 506 Variant Also Negotiates

* 507 Insufficient Storage

* 508 Loop Detected

* 510 Not Extended

* 511 Network Authentication Required

* CSP directives
* base-uri

* block-all-mixed-content

* child-src

* connect-src

* default-src

* fenced-frame-src

* font-src

* form-action

* frame-ancestors

* frame-src

* img-src

* manifest-src

* media-src

* object-src

* prefetch-src

* report-to

* report-uri

* require-trusted-types-for

* sandbox

* script-src

* script-src-attr

* script-src-elem

* style-src

* style-src-attr

* style-src-elem

* trusted-types

* upgrade-insecure-requests

* worker-src

* Permissions-Policy directives
* accelerometer

* ambient-light-sensor

* aria-notify

* attribution-reporting

* autoplay

* bluetooth

* browsing-topics

* camera

* captured-surface-control

* ch-ua-high-entropy-values

* compute-pressure

* cross-origin-isolated

* deferred-fetch

* deferred-fetch-minimal

* display-capture

* encrypted-media

* fullscreen

* gamepad

* geolocation

* gyroscope

* hid

* identity-credentials-get

* idle-detection

* language-detector

* language-model

* local-fonts

* local-network

* local-network-access

* loopback-network

* magnetometer

* microphone

* midi

* on-device-speech-recognition

* otp-credentials

* payment

* picture-in-picture

* private-state-token-issuance

* private-state-token-redemption

* publickey-credentials-create

* publickey-credentials-get

* screen-wake-lock

* serial

* speaker-selection

* storage-access

* summarizer

* translator

* usb

* web-share

* window-management

* xr-spatial-tracking

* HTTP resources and specifications

Your blueprint for a better internet.

*

*

*

*

*

MDN

*

About

*

Blog

*

Mozilla careers

*

Advertise with us

*

MDN Plus

*

Product help

Contribute

*

MDN Community

*

Community resources

*

Writing guidelines

*

MDN Discord

*

MDN on GitHub

Developers

*

Web technologies

*

Learn web development

*

Guides

*

Tutorials

*

Glossary

*

Hacks blog

*
Website Privacy Notice

*
Telemetry Settings

*
Legal

*
Community Participation Guidelines

Portions of this content are ©1998–2026 by individual mozilla.org contributors. Content available under a Creative Commons license .

Links found on this page

Skip to main content [direct]
HTML: Markup language [direct]
Elements [direct]
Global attributes [direct]
Attributes [direct]
See all… [direct]
Responsive images [direct]
HTML cheatsheet [direct]
Date & time formats [direct]
See all… [direct]
SVG [direct]
MathML [direct]
XML [direct]
CSS: Styling language [direct]
Properties [direct]
Selectors [direct]
At-rules [direct]
Values [direct]
See all… [direct]
Box model [direct]
Animations [direct]
Flexbox [direct]
Colors [direct]
See all… [direct]
Column layouts [direct]
Centering an element [direct]
Card component [direct]
See all… [direct]
JavaScript: Scripting language [direct]
Standard built-in objects [direct]
Expressions & operators [direct]
Statements & declarations [direct]
Functions [direct]
See all… [direct]
Control flow & error handing [direct]
Loops and iteration [direct]
Working with objects [direct]
Using classes [direct]
See all… [direct]
Web APIs: Programming interfaces [direct]
File system API [direct]
Fetch API [direct]
Geolocation API [direct]
HTML DOM API [direct]
Push API [direct]
Service worker API [direct]
Using the Web animation API [direct]
Using the Fetch API [direct]
Working with the History API [direct]
Using the Web speech API [direct]
Using web workers [direct]
All web technology [direct]
Accessibility [direct]
HTTP [direct]
URI [direct]
Web extensions [direct]
WebAssembly [direct]
WebDriver [direct]
Media [direct]
Performance [direct]
Privacy [direct]
Security [direct]
Progressive web apps [direct]
Learn web development [direct]
Getting started modules [direct]
Core modules [direct]
MDN Curriculum [direct]
Check out the video course from Scrimba, our partner [direct]
Structuring content with HTML module [direct]
CSS styling basics module [direct]
CSS layout module [direct]
Dynamic scripting with JavaScript module [direct]
Playground [direct]
HTTP Observatory [direct]
Border-image generator [direct]
Border-radius generator [direct]
Box-shadow generator [direct]
Color format converter [direct]
Color mixer [direct]
Shape generator [direct]