---
schema_version: "1"
id: 1fb5e2c9608ece65c193db3ab73b5ecb3778a4a97c72521b3f2e8319f912545d
title: Credential Injection Basic Authentication Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.9/policies-outbound-basic-auth.md
canonical_url: https://docs.mulesoft.com/gateway/1.9/policies-outbound-basic-auth
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 7abf067819d112e10e60591eb4b43f788976829b461a3bd48bb76c7b1f59c222
description: MuleSoft Documentation Site
release: "1.9"
latest: false
---
---
product: Omni Gateway
version: 1.9
keywords: basic authentication, api gateway, flex gateway, gateway, policy
---

# Credential Injection Basic Authentication Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>Credential Injection Basic Authentication</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Injects a basic authorization header into outgoing requests</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>Security</p></td></tr><tr><td><p><strong>First Flex Gateway version available</strong></p></td><td><p>v1.9.0</p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>No return codes exist for this policy. Error codes are returned from the upstream service.</p></td></tr></tbody></table>

## Summary

The Credential Injection Basic Authentication policy injects an `Authorization` header containing a
username and password into outbound requests. The policy ensures that requests sent from Flex
Gateway to an upstream service include the correct authentication headers. The Authorization header
format is `Authorization: Basic <username:password>`.

The policy follows
[Basic HTTP authentication standards](https://datatracker.ietf.org/doc/html/rfc7617).

When an error occurs, the policy returns a `WWW-Authenticate` HTTP header field.

## Configuring Policy Parameters

### Flex Gateway Local Mode

In Local Mode, you apply the policy to your API via declarative configuration files. Refer to the
following policy definition and table of parameters:

\- policyRef: name: credential-injection-basic-auth-flex config: username: <string> // OPTIONAL
password: <string> // OPTIONAL overwrite: <boolean> // OPTIONAL customHeader: <string> // OPTIONAL

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required or Optional</th><th>Default Value</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>username</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>The username for the basic authentication credentials.</p></div></div></td></tr><tr><td><div><div><p><code>password</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>The password for the basic authentication credentials.</p></div></div></td></tr><tr><td><div><div><p><code>overwrite</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>true</p></div></div></td><td><div><div><p>When enabled, if the <code>Authorization</code> header is present, the policy overwrites it with the configured credentials.</p></div></div></td></tr><tr><td><div><div><p><code>customHeader</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>When configured, a custom header is injected instead of the <code>Authorization</code> header. If <strong>Overwrite header</strong> is enabled, the policy overwrites the custom header if present instead of the <code>Authorization</code> header.</p></div></div></td></tr></tbody></table>

#### Resource Configuration Example

\- policyRef: name: http-basic-authentication-flex config: username: chris password: admin

### Managed Flex Gateway and Flex Gateway Connected Mode

When you apply the policy to your API instance from the UI, the following parameters are displayed:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Description</th><th>Required?</th></tr></thead><tbody><tr><td><p>Username</p></td><td><p>The username for the basic authentication credentials.</p></td><td><p>Optional</p></td></tr><tr><td><p>Password</p></td><td><p>The password for the basic authentication credentials.</p></td><td><p>Optional</p></td></tr><tr><td><p>Overwrite header</p></td><td><p>When enabled, if the <code>Authorization</code> header is present, the policy overwrites it with the configured credentials.</p></td><td><p>Optional</p></td></tr><tr><td><p>Custom Header</p></td><td><p>When configured, a custom header is injected instead of the <code>Authorization</code> header. If <strong>Overwrite header</strong> is enabled, the policy overwrites the custom header if present instead of the <code>Authorization</code> header.</p></td><td><p>Optional</p></td></tr></tbody></table>