Authenticate with HTTP Digest auth

GEThttps://api.testingapis.com/api/auth/digestSign in to see this endpoint's URL

Authenticate with HTTP Digest auth (MD5, qop=auth).

Credentials: apibee / password123, realm apibee. A request without credentials gets 401 with a WWW-Authenticate: Digest challenge carrying nonce and opaque; clients such as curl --digest, Postman and requests.auth.HTTPDigestAuth then retry automatically.

response = MD5(HA1:nonce:nc:cnonce:qop:HA2) where HA1 = MD5(username:realm:password) and HA2 = MD5(method:uri). Without qop: MD5(HA1:nonce:HA2). Nonces expire after 5 minutes; the 401 then includes stale=true. Replays are refused: with qop=auth each request must use a higher nc than the last one for that nonce, and without qop a nonce works once.

Note: HTTP Digest (RFC 7616, MD5, qop=auth). First call returns 401 with a nonce; curl --digest / Postman handle the handshake.

HTTP Digest (MD5, qop=auth) — apibee / password123

Responses

200: Authenticated.
401: Missing or invalid Digest header, wrong credentials, or an unknown or stale nonce. Includes a fresh challenge.

Example

Request

curl -X GET "https://api.testingapis.com/api/auth/digest" \
  --digest -u apibee:password123 \
  -H "X-TestingApis-Key: YOUR_API_KEY"

Response200 OK

{"authenticated": true, "scheme": "digest", "user": "apibee", "qop": "auth"}

The parameters, request and response examples and the live Try it panel for this endpoint are for signed-in members. Accounts are free and take a few seconds to create.

Try itSign-in requiredUses your key

api.testingapis.com

curl 'https://api.testingapis.com/api/auth/digest' \
  -H 'X-TestingApis-Key: YOUR_API_KEY' \
  --digest -u 'apibee:password123'

const res = await fetch("https://api.testingapis.com/api/auth/digest", {
  headers: {
    "X-TestingApis-Key": "YOUR_API_KEY",
  },
});
console.log(res.status, await res.text());

import requests
from requests.auth import HTTPDigestAuth

res = requests.get(
    "https://api.testingapis.com/api/auth/digest",
    headers={
        "X-TestingApis-Key": "YOUR_API_KEY",
    },
    auth=HTTPDigestAuth("apibee", "password123"),
)
print(res.status_code, res.text)

using System.Net;

using var client = new HttpClient(new HttpClientHandler
{
    Credentials = new NetworkCredential("apibee", "password123"), // answers the Digest challenge
});
using var request = new HttpRequestMessage(HttpMethod.Get, "https://api.testingapis.com/api/auth/digest");
request.Headers.TryAddWithoutValidation("X-TestingApis-Key", "YOUR_API_KEY");
using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");

HTTP Digest (MD5, qop=auth) — apibee / password123

GEThttps://api.testingapis.com/api/auth/digest

Query

Headers

Digest authentication needs the browser's own login prompt. Open the URL in a new tab to try it, or use the curl example.

Open in a new tab

Authenticate with HTTP Digest auth

Responses

Example

Related