---
title: "HTTP Basic authentication"
method: GET
path: "/credentials/basic"
tags: ["Account Management"]
---

# HTTP Basic authentication

`GET /credentials/basic`

Checks the credentials provided through [HTTP Basic Authentication
according to RFC 7617](https://www.rfc-editor.org/rfc/rfc7617.html) and
returns an access token in exchange for providing valid credentials.

The credentials (username and password) MUST be sent in the HTTP header
`Authorization` with type `Basic` and the Base64 encoded string
consisting of username and password separated by a double colon `:`. The
header would look as follows for username `user` and password `pw`:
`Authorization: Basic dXNlcjpwdw==`.

The access token has to be used in the Bearer token for authorization in
subsequent API calls (see also the information about Bearer tokens in
this document).

It is RECOMMENDED to implement this authentication method for non-public
services only.

## Response `200`

Credentials are correct and authentication succeeded.

- object
  - `access_token` string, required — The access token to be used in the Bearer token for authorization in subsequent API calls (without the custom `basic//` prefix).

## Other responses

- `4XX` — The request can not be fulfilled due to an error on client-side, i.e. the request is invalid. The client SHOULD NOT repeat the request without modifications. The response body SHOULD contain a JSON error object. MUST be any HTTP status code specified in [RFC 7231](https://www.rfc-editor.org/rfc/rfc7231.html#section-6.6). This request MUST respond with HTTP status codes 401 if authorization is required or 403 if the authorization failed or access is forbidden in general to the authenticated user. HTTP status code 404 SHOULD be used if the value of a path parameter is invalid. See also: * [Error Handling](#section/API-Principles/Error-Handling) in the API in general. * [Common Error Codes](errors.json)
- `5XX` — The request can not be fulfilled due to an error at the back-end. The error is never the client’s fault and therefore it is reasonable for the client to retry the exact same request that triggered this response. The response body SHOULD contain a JSON error object. MUST be any HTTP status code specified in [RFC 7231](https://www.rfc-editor.org/rfc/rfc7231.html#section-6.6). See also: * [Error Handling](#section/API-Principles/Error-Handling) in the API in general. * [Common Error Codes](errors.json)

---

[API](https://skmtc.net/open-eo/apis/openeo-api.md) · [All operations](https://skmtc.net/open-eo/apis/openeo-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/open-eo/openeo-api/revisions/0c5e31955a19/schema)