# Authorization for API calls

For authenticating API calls, Kloudfuse supports basic authorization, using local user and password credentials.

To configure local users, see [Add Users](https://docs.kloudfuse.com/platform/3.3.6/install-add-users/).

## Client side authorization

When sending authentication credentials to the server, we recommend that you configure the user agent to use an Authorization header field.

To construct the authorization header field, follow these steps:

1. Combine the `username` and `password` using a colon, `:`:

```code
   username:password (1)
   ```
   
   |     |     |
   | --- | --- |
   | **1** | The `username` cannot contain a colon |

2. Encode the resulting string into an octet sequence.

Any character set works, if it is compatible with US-ASCII.

The server _may_ suggest using UTF-8 by sending the `charset` parameter.

3. Encode the result using a variant of Base64 (+/ and with padding).

4. Prepend the authorization method and a space character (example: "Basic ") to the encoded string.

### Header encoding example

If the username is `Aladdin` and password is `open sesame`, the field’s value is the Base64 encoding of `Aladdin:open sesame`, or `QWxhZGRpbjpvcGVuIHNlc2FtZQ==`.

Then the Authorization header field appear as:

```code
Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==

'Basic ' + base64.b64encode(f"{<clientid>}:{<client secret key>}").encode()).decode()
```

## Authorization for a single query Request

1. When issuing a `curl` command, supply the `<username>` argument.

```console
   curl -u <username> <rest of the command>
   ```

2. The system prompts the user to enter the password, then processes the query.