Proper way to put a fixed hash as Authorization

Question

I am implementing a system for a customer where they are asking me to use a fixed hash to protect the API as authorization. So this fixed value will be sent in the HEADER of the HTTP call as "Authorization":"[the hash]".

Meanwhile, when I was looking for RFC implementations I got to know that Authorization: <type> <credentials> pattern was introduced by the W3C in HTTP 1.0. Can somebody please tell me what I am doing is wrong (going against this standard).

So I was reviewing other APIs using a fixed hash value, and noticed that they are sending this in the URL parameters itself. eg: POST https://language.googleapis.com/v1/documents:analyzeEntities?key=API_KEY I would like to know what is the standard they are following.

Answer 1

I would like to know what is the standard they are following.

They are not following any standard. You can put into your URLs whatever you want. Only the format of the URLs are specified, not their content.

You can also put into your headers whatever you want, as long as your web server won't care. Yet if you use standard headers, most web servers will have expectation about their format and content and if you don't fulfill these expectations the web server might deny the request with an appropriate HTTP error code. On the other hand, servers will ignore headers they don't know about, so if you make up your own header, this will not be a problem and is also not forbidden by any standard.

Also interesting to read:
https://stackoverflow.com/a/19640336/15809