To send cURL with Basic Auth, you need to use the -u option with "login:password" where "login" and "password" are your credentials.
Here is a cURL Basic Auth example that sends a GET request to our hosted version of HTTPBin with Basic Auth credentials:
curl https://httpbin.scrapingbee.com/basic-auth/login/password \
-u "login:password"
The -u (or --user) option supplies the username and password. cURL automatically Base64-encodes the credentials and sends them in the HTTP Authorization header using Basic Authentication. You don't need to create the header yourself.
If the credentials are valid, the expected response looks like:
{
"authenticated": true,
"user": "login"
}
What is cURL?
cURL is an open-source command-line tool used to transfer data to and from a server. It is extremely versatile and supports various protocols including HTTP, FTP, SMTP, and many others. Developers commonly use cURL authentication to test APIs, download files, and automate network requests.
What is Basic Auth?
Basic Auth is a simple authentication scheme built into the HTTP protocol. The client sends HTTP requests with the Authorization header that contains the word "Basic" followed by a space and a base64-encoded string "username:password".
Common cURL Basic Auth errors
401 Unauthorized
The server couldn't authenticate your credentials.
- Check that the username and password are correct.
- Verify that the endpoint supports HTTP Basic Authentication.
403 Forbidden
The server authenticated your credentials but denied access to the requested resource.
- Verify that your account has permission to access the endpoint.
- Check whether the API requires additional permissions or scope.
Best practices for cURL Basic Auth in production code
Always use HTTPS over plain HTTP. Basic Auth only Base64-encodes your credentials; it doesn't encrypt them. If you send credentials over HTTP, anyone intercepting the traffic can decode them.
When using Basic Auth, avoid typing passwords directly on the command line. They can end up in your shell history (~/.bash_history) and are visible to other users on the same machine via ps aux while the command runs. Pass them via an environment variable (-u "login:$MY_PASSWORD") or a .netrc file instead.
Environment variable example:
export MY_PASSWORD="your-password"
curl https://httpbin.scrapingbee.com/basic-auth/login/password \
-u "login:$MY_PASSWORD"
In the above script, keep the -u value in quotes, especially if your password contains spaces or shell-special characters such as $, !, or &. Also, remember that Basic Auth uses the format username:password, so usernames containing : can be ambiguous and should be avoided.
If you use the same credentials repeatedly, you can also store them in ~/.netrc with restricted file permissions and run cURL with --netrc.
machine httpbin.scrapingbee.com
login login
password your-password
curl --netrc https://httpbin.scrapingbee.com/basic-auth/login/password
Using an environment variable is safer than putting the password directly in the command, but it isn't a complete secret management solution. Depending on your environment, the value can still be exposed through process information, debugging tools, or logs. If you're building production applications or automated workflows, load credentials from a secrets manager whenever possible.
Finally, avoid hardcoding credentials in scripts or committing them to version control. If you need long-term authentication for production APIs, prefer API keys or Bearer tokens over Basic Auth. They're easier to rotate, and can be revoked without changing a shared username and password.