Skip to main content
HTTP Basic Auth is a fallback authentication method supported by Avalex. It is most useful for quick manual testing with curl, where you want to make an authenticated request without first obtaining a JWT token. For any production integration, JWT authentication is strongly recommended instead.

​
How Basic Auth Works

You Base64-encode the string username:password and pass the result in the Authorization header on every request:

​
Making a Request with Basic Auth

The easiest way to use Basic Auth is to let curl handle the encoding for you with the -u flag:

​
Constructing the Header Manually

If you need to build the header yourself — for example, in a script or HTTP client that does not handle Basic Auth natively — you can Base64-encode your credentials and include them directly:

​
Staff Account Requirements

For a staff account to authenticate successfully, it must have active: true set in its configuration. Requests from inactive accounts are rejected regardless of whether the credentials are correct.
Unlike JWT, Basic Auth requires credentials to be verified server-side on every request, which adds overhead. For production applications with frequent API calls, use JWT tokens instead.
Always use HTTPS when sending Basic Auth credentials. Over plaintext HTTP, your Base64-encoded password is trivially decoded by anyone who can observe the request in transit.