Basic Auth vs $_POST for just login, tokens otherwise

Question

Working on a side-project writing an API and when it comes to authentication I am a little stuck. I am trying to decide what the differences between using Basic Auth vs $_POST fields for the actual login.

Once the login gets posted, I will return a token to the client that will then be used on subsequent API calls.

My plan looks like this:

1. User enters username, password on client login form
2. Client will hash the password

3. Client will send username and hashed password to API TokenController over SSL

4. TokenController will hash password again and verify credentials against the database

5. If valid, returns a JWT and valid response to the client

6. If invalid, returns invalid response to client.

7. Client uses returned token to make other API calls like users/{id}

Only on the initial login will the credentials be sent in somewhat cleartext (they will be hashed). I think I could go with Basic Auth or sending as a normal POST and it would work fine.

Would either one work in this case?

Answer 1

Yes, either one would work. A more appropriate one would probably be the POST since basic auth isn't really used as a one time thing / token exchange mechanism.