I'm building an API provider using Craft and need to implement some kind of client authentication. I don't need to worry about individual users, but I'd like to require that clients authenticate in some way. My current thinking is the client can pass an authorization header header of some kind, or just use basic authentication to access the content on the Craft CMS site, I'm just not sure how to consume the header on the Craft side & validate it before serving the content. Can anyone offer up some tips on how to implement something like this using Craft?

1 Answer 1


It sounds like you're not necessarily interested in authenticating against Craft's current users, but you just want some type of header authentication in place.

If you set those header (via whatever means) in the API request, you can have a plugin's controller read those via HeaderHelper::getHelper($headerName) and perform whatever authentication logic that you require.

If authentication passes, let the request go through, if not, you can throw new HttpException(503);.

  • just thought that was particularly well answered, short of writing code. There may be other evidence you think well of things, Brad ;) Jan 20, 2015 at 3:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.