en

My progress Get started

API Testing

Auth Header Generator

Build Basic, Bearer and API key headers with cURL and Playwright.

Runs entirely in your browser No sign-up

Credentials stay in this browser tab

Encoding happens locally and nothing is stored or sent. Even so, prefer test accounts and short-lived tokens, and keep real secrets in environment variables or your CI secret store, not in test code.

Credentials

Request URL

Used in the cURL and Playwright snippets.

Username

Password

Show secrets while typing

Header

Authorization: Basic Og==

cURL

curl -u : https://api.example.com/v1/me

# or send the header explicitly:
curl -H 'Authorization: Basic Og==' https://api.example.com/v1/me

Playwright: extraHTTPHeaders

// playwright.config.ts
import { defineConfig } from '@playwright/test';

export default defineConfig({
  use: {
    baseURL: 'https://api.example.com',
    extraHTTPHeaders: {
      Authorization: `Basic ${Buffer.from(`${process.env.API_USER}:${process.env.API_PASSWORD}`).toString('base64')}`,
    },
    // Alternative: let Playwright answer the 401 challenge instead of always sending the header
    // httpCredentials: { username: process.env.API_USER!, password: process.env.API_PASSWORD! },
  },
});

// Set API_USER=<user> and API_PASSWORD in your environment or CI secrets.
// Encoded value for these credentials: Basic Og==

About this tool

Authentication is the first thing an API test needs and a common source of confusing 401s: a password with non-ASCII characters encoded with btoa, a token pasted with “Bearer” already in it, or an API key sent in a query string that ends up in logs. This tool builds the header for Basic auth (RFC 7617, UTF-8 encoded before Base64), Bearer tokens (RFC 6750) and API keys in a header or query parameter, and shows the matching curl command and a Playwright config using extraHTTPHeaders with secrets read from environment variables. For OAuth 2.0 client credentials it shows the token request as curl and a small Playwright helper, because that flow exchanges credentials for a token rather than sending a fixed header. Inputs are never saved or sent anywhere.

How to use it

Choose the scheme: Basic, Bearer token, API key or OAuth 2.0 client credentials.
Enter the credentials and the request URL. Warnings appear for common mistakes such as a colon in a Basic username or plain http://.
Copy the header line, the curl command or the Playwright snippet, and move the secret into an environment variable before committing.

Auth Header Generator FAQ

Is Base64 in Basic auth a form of encryption?

No. Base64 is an encoding that anyone can reverse. Basic auth is only safe over HTTPS, and the credentials are sent with every request.

Why does btoa fail on my password?

btoa only accepts Latin-1 characters, so characters such as € or emoji throw an error. RFC 7617 recommends UTF-8, so this tool encodes the text as UTF-8 bytes first, which is what servers expecting UTF-8 will decode.

Where should test credentials live?

In environment variables or your CI secret store, never in the repository. The Playwright snippets read process.env values for that reason. Prefer dedicated test accounts with minimal permissions and short-lived tokens.