Pass Access Token via Basic Auth vs Query String

Question

When designing an API, is it best to allow the client to pass an access token only via basic access authentication, as does the Stripe API, or only via query string, as does the Facebook's Graph API, or via both, as does the GitHub API?

Mendhak · Accepted Answer · 2014-01-26 20:28:05Z

3

As often comes up in similar threads, it is ideal/better to put it in the header. However, when it comes to compatibility or legacy technologies (JSONP) or insincere proxies (remove headers), you end up having to put it in the querystring.

In other words, you put it into the querystring in order to be as 'compatible' and accessible as possible to all client technologies.

answered Jan 26, 2014 at 20:28

Mendhak

8,9926 gold badges56 silver badges76 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Pass Access Token via Basic Auth vs Query String

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related