# REST Adapter authentication

This page describes how to authenticate REST requests initiated by the REST Adapter to a REST API service.

**Available from:** Liberator 8.0.0

**Requires:** OpenJDK 17/21, Caplin StreamLink 8.0.0, Caplin Deployment Framework 8.0.0

## Authorization header provided in StreamLink RTTP request

The REST Adapter will use any valid `Authorization` header provided in the RTTP request to authorise the request with the REST service. If more than one `Authorization` header is provided in the RTTP request, the last of these is used. A StreamLink client can provide this header together with any other HTTP headers.

**Authorization header provided in StreamLink method (token authentication)**

```js
streamLink.snapshot("/NEWS/123456", subscriptionListener, {
  headers:[
      {header:"Authorization",value:"Bearer <token>"}, 
      {header:"other-header-name",value:"other-header-value"}
  ]
});
```

## Configured Authorization Header

When no valid `Authorization` header is provided in an RTTP request, the REST Adapter can fall back on an `Authorization` [`http-header`](liberator-rest-configuration.md#http-header) in the REST endpoint’s configuration. If more than one `Authorization` `http-header` is configured, the last of these is used in the request. 

**Configured `Authorization` http-header**

```
add-rest-mapping
   …
   http-header        Authorization  "__http-auth-scheme__ __api-credentials-or-token__"
end-rest-mapping
```

## Configured Basic HTTP Authorization

When no valid `Authorization` header is provided in an RTTP request or configured on the REST endpoint’s configuration, the REST Adapter can fall back on Basic Authorization using credentials in the REST endpoint’s configuration. The credentials provided in the [`auth-username`](liberator-rest-configuration.md#auth-username) and [`auth-password`](liberator-rest-configuration.md#auth-password) options will be used to attempt authorisation with the REST service using the ["Basic" HTTP authentication scheme](https://datatracker.ietf.org/doc/html/rfc7617).

**Configured Basic HTTP authentication**

```
add-rest-mapping
   …
   auth-username      __username__
   auth-password      __password__
end-rest-mapping
```

## No Authorization

Should the REST Adapter fail to locate a valid `Authorization` header in the request or configuration or configured credentials, it will attempt to make a request to the REST service with no authentication information.

**See also:**

* [Liberator REST Adapter](liberator-rest-adapter.md)
* [REST Adapter Configuration](liberator-rest-configuration.md)