> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/fastapi/fastapi/llms.txt
> Use this file to discover all available pages before exploring further.

# HTTP Authentication

> HTTP Basic, Bearer, and Digest authentication classes

## HTTPBasic

HTTP Basic authentication.

Create an instance object and use that object as the dependency in `Depends()`. The dependency result will be an `HTTPBasicCredentials` object containing the `username` and the `password`.

**Reference:** [RFC 7617](https://datatracker.ietf.org/doc/html/rfc7617)

### Parameters

<ParamField path="scheme_name" type="str | None" default="None">
  Security scheme name. It will be included in the generated OpenAPI (e.g. visible at `/docs`).
</ParamField>

<ParamField path="realm" type="str | None" default="None">
  HTTP Basic authentication realm.
</ParamField>

<ParamField path="description" type="str | None" default="None">
  Security scheme description. It will be included in the generated OpenAPI (e.g. visible at `/docs`).
</ParamField>

<ParamField path="auto_error" type="bool" default="True">
  By default, if the HTTP Basic authentication is not provided (a header), `HTTPBasic` will automatically cancel the request and send the client an error.

  If `auto_error` is set to `False`, when the HTTP Basic authentication is not available, instead of erroring out, the dependency result will be `None`.

  This is useful when you want to have optional authentication or when you want to have authentication that can be provided in one of multiple optional ways (for example, in HTTP Basic authentication or in an HTTP Bearer token).
</ParamField>

### Example

```python theme={null}
from typing import Annotated
from fastapi import Depends, FastAPI
from fastapi.security import HTTPBasic, HTTPBasicCredentials

app = FastAPI()

security = HTTPBasic()

@app.get("/users/me")
def read_current_user(credentials: Annotated[HTTPBasicCredentials, Depends(security)]):
    return {"username": credentials.username, "password": credentials.password}
```

***

## HTTPBasicCredentials

The HTTP Basic credentials given as the result of using `HTTPBasic` in a dependency.

### Fields

<ParamField path="username" type="str">
  The HTTP Basic username.
</ParamField>

<ParamField path="password" type="str">
  The HTTP Basic password.
</ParamField>

***

## HTTPBearer

HTTP Bearer token authentication.

Create an instance object and use that object as the dependency in `Depends()`. The dependency result will be an `HTTPAuthorizationCredentials` object containing the `scheme` and the `credentials`.

### Parameters

<ParamField path="bearerFormat" type="str | None" default="None">
  Bearer token format.
</ParamField>

<ParamField path="scheme_name" type="str | None" default="None">
  Security scheme name. It will be included in the generated OpenAPI (e.g. visible at `/docs`).
</ParamField>

<ParamField path="description" type="str | None" default="None">
  Security scheme description. It will be included in the generated OpenAPI (e.g. visible at `/docs`).
</ParamField>

<ParamField path="auto_error" type="bool" default="True">
  By default, if the HTTP Bearer token is not provided (in an `Authorization` header), `HTTPBearer` will automatically cancel the request and send the client an error.

  If `auto_error` is set to `False`, when the HTTP Bearer token is not available, instead of erroring out, the dependency result will be `None`.

  This is useful when you want to have optional authentication or when you want to have authentication that can be provided in one of multiple optional ways (for example, in an HTTP Bearer token or in a cookie).
</ParamField>

### Example

```python theme={null}
from typing import Annotated
from fastapi import Depends, FastAPI
from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer

app = FastAPI()

security = HTTPBearer()

@app.get("/users/me")
def read_current_user(
    credentials: Annotated[HTTPAuthorizationCredentials, Depends(security)]
):
    return {"scheme": credentials.scheme, "credentials": credentials.credentials}
```

***

## HTTPDigest

HTTP Digest authentication.

**Warning:** this is only a stub to connect the components with OpenAPI in FastAPI, but it doesn't implement the full Digest scheme, you would need to to subclass it and implement it in your code.

**Reference:** [RFC 7616](https://datatracker.ietf.org/doc/html/rfc7616)

Create an instance object and use that object as the dependency in `Depends()`. The dependency result will be an `HTTPAuthorizationCredentials` object containing the `scheme` and the `credentials`.

### Parameters

<ParamField path="scheme_name" type="str | None" default="None">
  Security scheme name. It will be included in the generated OpenAPI (e.g. visible at `/docs`).
</ParamField>

<ParamField path="description" type="str | None" default="None">
  Security scheme description. It will be included in the generated OpenAPI (e.g. visible at `/docs`).
</ParamField>

<ParamField path="auto_error" type="bool" default="True">
  By default, if the HTTP Digest is not provided, `HTTPDigest` will automatically cancel the request and send the client an error.

  If `auto_error` is set to `False`, when the HTTP Digest is not available, instead of erroring out, the dependency result will be `None`.

  This is useful when you want to have optional authentication or when you want to have authentication that can be provided in one of multiple optional ways (for example, in HTTP Digest or in a cookie).
</ParamField>

### Example

```python theme={null}
from typing import Annotated
from fastapi import Depends, FastAPI
from fastapi.security import HTTPAuthorizationCredentials, HTTPDigest

app = FastAPI()

security = HTTPDigest()

@app.get("/users/me")
def read_current_user(
    credentials: Annotated[HTTPAuthorizationCredentials, Depends(security)]
):
    return {"scheme": credentials.scheme, "credentials": credentials.credentials}
```

***

## HTTPAuthorizationCredentials

The HTTP authorization credentials in the result of using `HTTPBearer` or `HTTPDigest` in a dependency.

The HTTP authorization header value is split by the first space. The first part is the `scheme`, the second part is the `credentials`.

For example, in an HTTP Bearer token scheme, the client will send a header like:

```
Authorization: Bearer deadbeef12346
```

In this case:

* `scheme` will have the value `"Bearer"`
* `credentials` will have the value `"deadbeef12346"`

### Fields

<ParamField path="scheme" type="str">
  The HTTP authorization scheme extracted from the header value.
</ParamField>

<ParamField path="credentials" type="str">
  The HTTP authorization credentials extracted from the header value.
</ParamField>