I have exposed a REST API to be consumed by the set of internal applications. When an application calls the API it executes a 3rd party application for certain operations. To execute this it is required to send an userid and a password. REST API does not keep the credentils and the internal applications should send them in the POST request. What is the best way to send them. In the body with other data or header. I planned to use something like this Authorization: Basic Base64(UserName:Password).
Please advice?
I think the way you describe sending the username and the password in the header (encoding the username and password into a base64 format) will work until you retrieve an auth token. Once you get an auth token you should send that in the header instead of your username and password.