[
  {
    "scheme": "Basic",
    "description": "Transmits credentials as a Base64-encoded username and password pair in the Authorization header.",
    "reference": "RFC7617"
  },
  {
    "scheme": "Bearer",
    "description": "Uses bearer tokens, typically JWTs or opaque tokens, to access OAuth 2.0-protected resources.",
    "reference": "RFC6750"
  },
  {
    "scheme": "Concealed",
    "description": "Concealed HTTP authentication: the client proves possession of a key using a signature over TLS keying material, so the server can authenticate it without revealing to probes that the resource exists.",
    "reference": "RFC9729"
  },
  {
    "scheme": "Digest",
    "description": "Challenge-response scheme that applies a hash function to credentials to avoid sending passwords in cleartext.",
    "reference": "RFC7616"
  },
  {
    "scheme": "DPoP",
    "description": "Demonstration of Proof-of-Possession; binds access tokens to a client public key to prevent token replay.",
    "reference": "RFC9449, Section 7.1"
  },
  {
    "scheme": "GNAP",
    "description": "Grant Negotiation and Authorization Protocol; a next-generation delegation and authorization framework.",
    "reference": "RFC9635, Section 7.2"
  },
  {
    "scheme": "HOBA",
    "description": "HTTP Origin-Bound Authentication; uses digital signatures with an origin-bound key pair for authentication.",
    "reference": "RFC7486, Section 3"
  },
  {
    "scheme": "Mutual",
    "description": "Password-based mutual authentication in which client and server prove knowledge of the password to each other without sending it (experimental).",
    "reference": "RFC8120"
  },
  {
    "scheme": "Negotiate",
    "description": "SPNEGO-based scheme supporting Kerberos and NTLM for Windows-integrated authentication.",
    "reference": "RFC4559, Section 3"
  },
  {
    "scheme": "OAuth",
    "description": "OAuth 1.0 authentication using signed requests with consumer key, token, and HMAC signature.",
    "reference": "RFC5849, Section 3.5.1"
  },
  {
    "scheme": "PrivateToken",
    "description": "Privacy Pass protocol tokens allowing anonymous, rate-limited authentication without tracking.",
    "reference": "RFC9577, Section 2"
  },
  {
    "scheme": "SCRAM-SHA-1",
    "description": "Salted Challenge Response Authentication Mechanism using SHA-1; provides mutual authentication.",
    "reference": "RFC7804"
  },
  {
    "scheme": "SCRAM-SHA-256",
    "description": "Salted Challenge Response Authentication Mechanism using SHA-256; stronger variant of SCRAM.",
    "reference": "RFC7804"
  },
  {
    "scheme": "vapid",
    "description": "Voluntary Application Server Identification for Web Push; authenticates push notification senders.",
    "reference": "RFC8292, Section 3"
  }
]