I'm building an API provider using Craft and need to implement some kind of client authentication. I don't need to worry about individual users, but I'd like to require that clients authenticate in some way. My current thinking is the client can pass an authorization header header of some kind, or just use basic authentication to access the content on the Craft CMS site, I'm just not sure how to consume the header on the Craft side & validate it before serving the content. Can anyone offer up some tips on how to implement something like this using Craft?
It sounds like you're not necessarily interested in authenticating against Craft's current users, but you just want some type of header authentication in place.
If you set those header (via whatever means) in the API request, you can have a plugin's controller read those via HeaderHelper::getHelper($headerName) and perform whatever authentication logic that you require.
If authentication passes, let the request go through, if not, you can
throw new HttpException(503);.