To disagree with the chosen answer: using the Authorization header seems like the right thing to do. It's the entire purpose of the Authorization header. From http://tools.ietf.org/html/rfc7235#section-4.2 : > The "Authorization" header field allows a user agent to authenticate > itself with an origin server -- usually, but not necessarily, after > receiving a 401 (Unauthorized) response. Its value consists of > credentials containing the authentication information of the user > agent for the realm of the resource being requested. If you have your own auth scheme document it, but there's no need to reinvent the wheel.