HTTP Authentication
Not every client supports every authentication scheme natively. This matrix shows which clients handle each scheme automatically, which require manual setup, and which are unsupported.
| Client | Basic RFC 7617 | Digest RFC 7616 | Bearer RFC 6750 | Bearer + Discovery RFC 9728 |
|---|---|---|---|---|
Chrome Browser — native credential dialog | Native | Native | — | — |
Firefox Browser — native credential dialog | Native | Native | — | — |
Safari Browser — native credential dialog | Native | Native | — | — |
curl Command-line HTTP tool | Partial | Partial | Partial | — |
wget Command-line HTTP tool | Partial | Partial | — | — |
http (HTTPie) Command-line HTTP tool with auth plugins | Partial | Partial | Partial | — |
fetch / XHR Browser-side JavaScript HTTP API | — | — | — | — |
axios JavaScript HTTP library | Partial | — | — | — |
requests Python HTTP library | Partial | Partial | — | — |
Postman API client with OAuth 2.0 support | Partial | Partial | Partial | — |
Insomnia API client with OAuth 2.0 support | Partial | Partial | Partial | — |
Claude MCP client — Model Context Protocol | — | — | Partial | Native |
Perplexity MCP client — Model Context Protocol | — | — | Partial | Native |
Use only for internal tooling, legacy systems, or when HTTPS is guaranteed and no better option exists. Broad client support makes it tempting, but the password is reversibly encoded — treat every request as if it sends the plaintext password.
An improvement over Basic but limited to environments where browsers handle it natively. Poor JavaScript and modern-framework support makes it impractical for new APIs.
The standard for modern APIs. Any client that can set a request header works. Token issuance (OAuth 2.0 flows) must be configured externally — use RFC 9728 discovery if you want zero-config clients.
Ideal for ecosystems where clients cannot be pre-configured: AI agents, MCP servers, and federated APIs. A single 401 response gives the client everything it needs to discover the authorization server and obtain a token.