HTTP authentication proves the client's identity on each request, most often through the Authorization header: the Basic scheme (encoded username and password) or Bearer (token). A failure returns 401; denied access for a known user returns 403. Always over HTTPS.
Example
Authorization: Bearer eyJhbGciOi...