staticdata.dev
Menu
Datasets About Contact

HTTP Authentication Schemes

The complete set of HTTP authentication schemes registered with IANA, as defined in the HTTP Authentication Scheme Registry. Each entry includes the canonical scheme name, a description of its mechanism and purpose, and the authoritative RFC reference. The dataset covers all 14 registered schemes including foundational schemes like Basic and Bearer, modern token-based approaches like DPoP and PrivateToken, and challenge-response mechanisms like Digest and SCRAM.

v1.0.0 MIT 14 records Updated 2026-10-05 stable Source:  IANA HTTP Authentication Scheme Registry

Quick fetch

Stable URL. CORS-enabled. No auth.

bash 
curl https://staticdata.dev/v1/http-auth-schemes.json

Or use as a typed import: import { httpAuthSchemes } from "https://staticdata.dev/v1/http-auth-schemes.ts"

Formats

  • JSON 2.7 KB

    /v1/http-auth-schemes.json

    Open

    min: 2.4 KB · /v1/http-auth-schemes.min.json

  • CSV 1.9 KB

    /v1/http-auth-schemes.csv

    Open
  • TypeScript 2.9 KB

    /v1/http-auth-schemes.ts

    export const httpAuthSchemes

    type AuthScheme = (typeof httpAuthSchemes)[number]

    Open

Schema

Each record in the dataset has the following shape.

Schema
Field Type Description Example
scheme string The authentication scheme name as used in the Authorization/WWW-Authenticate headers Bearer
description string A concise description of the scheme's mechanism and purpose Uses bearer tokens, typically JWTs or opaque tokens, to access OAuth 2.0-protected resources.
reference string The authoritative RFC or specification reference for this scheme RFC6750

Preview

First 10 records.

Data preview
schemedescriptionreference
BasicTransmits credentials as a Base64-encoded username and password pair in the Authorization header.RFC7617
BearerUses bearer tokens, typically JWTs or opaque tokens, to access OAuth 2.0-protected resources.RFC6750
ConcealedConcealed HTTP authentication: the client proves possession of a key using a signature over TLS keying material, so the server can authenticate it without revealing to probes that the resource exists.RFC9729
DigestChallenge-response scheme that applies a hash function to credentials to avoid sending passwords in cleartext.RFC7616
DPoPDemonstration of Proof-of-Possession; binds access tokens to a client public key to prevent token replay.RFC9449, Section 7.1
GNAPGrant Negotiation and Authorization Protocol; a next-generation delegation and authorization framework.RFC9635, Section 7.2
HOBAHTTP Origin-Bound Authentication; uses digital signatures with an origin-bound key pair for authentication.RFC7486, Section 3
MutualPassword-based mutual authentication in which client and server prove knowledge of the password to each other without sending it (experimental).RFC8120
NegotiateSPNEGO-based scheme supporting Kerberos and NTLM for Windows-integrated authentication.RFC4559, Section 3
OAuthOAuth 1.0 authentication using signed requests with consumer key, token, and HMAC signature.RFC5849, Section 3.5.1

Showing 10 of 14. View full data:  JSON · CSV

Fetch examples

Drop-in snippets in five languages.

curl 
curl -sSL https://staticdata.dev/v1/http-auth-schemes.json | jq '.[0]'
JavaScript 
import type { AuthScheme } from "https://staticdata.dev/v1/http-auth-schemes.ts";

const res = await fetch("https://staticdata.dev/v1/http-auth-schemes.min.json");
if (!res.ok) throw new Error(`Fetch failed: ${res.status}`);
const httpAuthSchemes: AuthScheme[] = await res.json();
console.log(httpAuthSchemes[0]);
Python 
import urllib.request, json

with urllib.request.urlopen("https://staticdata.dev/v1/http-auth-schemes.min.json") as r:
    httpAuthSchemes = json.load(r)

print(httpAuthSchemes[0])
Go 
package main

import (
	"encoding/json"
	"fmt"
	"net/http"
)

func main() {
	resp, err := http.Get("https://staticdata.dev/v1/http-auth-schemes.min.json")
	if err != nil { panic(err) }
	defer resp.Body.Close()

	var data []map[string]any
	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
		panic(err)
	}
	fmt.Println(data[0])
}
Rust 
use serde_json::Value;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let body = ureq::get("https://staticdata.dev/v1/http-auth-schemes.min.json").call()?.into_string()?;
    let data: Vec<Value> = serde_json::from_str(&body)?;
    println!("{:?}", data.first());
    Ok(())
}

Sources and methodology

The data is sourced directly from the IANA HTTP Authentication Scheme Registry, the authoritative registry maintained by the Internet Assigned Numbers Authority. Each authentication scheme listed has been formally registered and is defined by the corresponding RFC or IETF specification. The dataset includes all 14 schemes registered as of October 2026.

HTTP authentication schemes are used in the Authorization request header and WWW-Authenticate response header to negotiate credentials between clients and servers. The registry spans a wide range of mechanisms: Basic and Digest are the oldest and most widely deployed; Bearer underpins the OAuth 2.0 ecosystem and is ubiquitous in modern APIs; Negotiate enables Windows-integrated Kerberos/NTLM authentication; DPoP and PrivateToken represent newer privacy-preserving approaches; and SCRAM-SHA-1/SCRAM-SHA-256 provide salted challenge-response authentication suitable for use over TLS.

Descriptions are concise paraphrases of the normative RFC definitions and are intended for developer quick-reference. The reference field contains the RFC number and optional section in the form used by IANA (e.g., RFC6750 or RFC9449, Section 7.1). Note that the Negotiate scheme, while widely deployed in enterprise environments, is documented by its RFC as violating HTTP semantics due to its connection-oriented nature.

Versioning

URLs under /v1/ are stable: field names and types will not change in a way that breaks consumers. Values can be corrected or records added when the upstream source changes; schema-incompatible updates ship under a new version path. See the http-auth-schemes changelog for this dataset's history.

Related datasets

More Web datasets