Digest Auth

Digest Authentication is an HTTP access control authentication mechanism that provides enhanced security over Basic Auth. While Basic Auth sends credentials in plaintext (Base64 encoded), Digest Auth uses cryptographic hashing to protect user credentials during transmission.

How Digest Auth Works

In Basic Auth, the client sends the username and password in Base64 encoding to the server. These credentials can be transmitted over the network and may be intercepted by a middleman, who can easily decode them.

Digest Authentication solves this problem by using encryption algorithms to protect the transmission of user credentials. Instead of sending the password, the client sends a hash of the password combined with other values (nonce, realm, etc.), making it much more difficult for attackers to intercept and reuse credentials.

Security Comparison

Basic Auth: Username and password sent in Base64 (easily decoded)
Digest Auth: Cryptographic hash sent instead of password (cannot be easily reversed)

Basic Settings

On the Auth page, select Digest Auth as the authorization method and configure your credentials:

Parameter	Description	Required
Username	Your authentication username	Yes
Password	Your authentication password	Yes

Advanced Settings

Click the Advanced option to configure additional encryption parameters. If left blank, they will be generated automatically based on the server's response.

Parameter	Description	Source
Realm	The protection space identifier	Provided by the server in the `WWW-Authenticate` header
Nonce	A unique server-specified string	Provided by the server in the `WWW-Authenticate` header
Algorithm	The cryptographic hash algorithm	MD5, SHA-256, SHA-256-sess, SHA-512-256, SHA-512-256-sess
qop (Quality of Protection)	The digest algorithm quality level	`auth` (authentication only) or `auth-int` (authentication + integrity)
Client Nonce	Client-generated random number	Generated by the client for each request
Opaque	Server-provided random string	Returned by the server, sent back unchanged

Quality of Protection (qop) Values

Value	Description	Use Case
auth	Authentication quality assurance	Standard digest authentication
auth-int	Authentication + integrity protection	Enhanced security with message integrity verification

Automatic Configuration

In most cases, you only need to provide your username and password. Apidog will automatically extract the Realm, Nonce, and other parameters from the server's initial response and configure them for you.

Algorithm Support

Ensure your API endpoint supports the selected algorithm. Modern implementations typically support SHA-256 or SHA-512 variants for enhanced security over the legacy MD5 algorithm.

How Digest Auth Works#

Basic Settings#

Advanced Settings#

Quality of Protection (qop) Values#

How Digest Auth Works

Basic Settings

Advanced Settings

Quality of Protection (qop) Values