HTTP Authentication
Not every client supports every authentication scheme natively. This matrix shows which clients handle each scheme automatically, which require manual setup, and which are unsupported.
| Client | Basic RFC 7617 | Digest MD5 RFC 7616 | Digest SHA-256 RFC 7616 | Bearer RFC 6750 | Bearer + Discovery RFC 9728 | NTLM MS-NLMP | Kerberos RFC 4559 |
|---|---|---|---|---|---|---|---|
Chrome Browser — native credential dialog (v117+) | Native | Native | Native | — | — | Native | — |
Firefox Browser — native credential dialog (v93+) | Native | Native | Native | — | — | Native | — |
Safari Browser — native credential dialog (WebKit, no SHA-256) | Native | Native | — | — | — | Native | — |
Edge Browser — native credential dialog (Chromium, v117+) | Native | Native | Native | — | — | Native | — |
curl Command-line HTTP tool (--digest flag; RFC 7616 full support) | Partial | Partial | Partial | Partial | — | Partial | Partial |
wget Command-line HTTP tool (MD5 only) | Partial | Partial | — | — | — | — | — |
http (HTTPie) Command-line HTTP tool (MD5 only via plugin) | Partial | Partial | — | Partial | — | — | — |
fetch / XHR Browser-side JavaScript HTTP API | — | — | — | — | — | — | — |
axios JavaScript HTTP library | Partial | — | — | — | — | — | — |
requests Python HTTP library (HTTPDigestAuth, MD5 only) | Partial | Partial | — | — | — | — | — |
Postman API client with OAuth 2.0 support | Partial | Partial | Partial | Partial | — | Partial | — |
Insomnia API client with OAuth 2.0 support (MD5 only) | Partial | Partial | — | Partial | — | — | — |
Claude MCP client — Model Context Protocol | — | — | — | Partial | Native | — | — |
Perplexity MCP client — Model Context Protocol | — | — | — | Partial | Native | — | — |
Use only for internal tooling, legacy systems, or when HTTPS is guaranteed and no better option exists. Broad client support makes it tempting, but the password is reversibly encoded — treat every request as if it sends the plaintext password.
An improvement over Basic but limited to environments where browsers handle it natively. Poor JavaScript and modern-framework support makes it impractical for new APIs.
The standard for modern APIs. Any client that can set a request header works. Token issuance (OAuth 2.0 flows) must be configured externally — use RFC 9728 discovery if you want zero-config clients.
Ideal for ecosystems where clients cannot be pre-configured: AI agents, MCP servers, and federated APIs. A single 401 response gives the client everything it needs to discover the authorization server and obtain a token.
Restricted to Windows-domain environments. Avoid for new web services — Kerberos or Bearer are the correct replacements. Use only when interoperating with legacy IIS, SharePoint, or other Microsoft systems where domain authentication is mandatory and cannot be modernized.
The preferred authentication method in Active Directory environments. Use when all clients are domain-joined and Single Sign-On is required — the user never sees a credential prompt. Requires the server to be registered as an SPN in Active Directory and browsers to be configured via enterprise policy. Not suitable for public internet APIs.