--- name: "CURLOPT_HTTPAUTH" section: "3" platform: "linux" package: "curl" version: "8.23.0-1" release: "Arch Linux 2026-11-01" platforms: ["linux", "macos"] url: "https://new.carta.tech/CURLOPT_HTTPAUTH" --- # CURLOPT\_HTTPAUTH(3) HTTP server authentication methods to try ## NAME CURLOPT\_HTTPAUTH - HTTP server authentication methods to try ## SYNOPSIS ``` #include CURLcode curl_easy_setopt(CURL *handle, CURLOPT_HTTPAUTH, long bitmask); ``` ## DESCRIPTION Pass a long as parameter, which is set to a bitmask, to tell libcurl which authentication method(s) you want it to use speaking to the remote server. The available bits are listed below. If more than one bit is set, libcurl first queries the host to see which authentication methods it supports and then picks the best one you allow it to use. For some methods, this induces an extra network round-trip. Set the actual name and password with the *[CURLOPT\_USERPWD(3)](/CURLOPT_USERPWD/3.md)* option or with the *[CURLOPT\_USERNAME(3)](/CURLOPT_USERNAME/3.md)* and the *[CURLOPT\_PASSWORD(3)](/CURLOPT_PASSWORD/3.md)* options. Custom *Authorization:* headers set with *[CURLOPT\_HTTPHEADER(3)](/CURLOPT_HTTPHEADER/3.md)* may interfere with and cause unintended side-effects if combined with authentication set with *[CURLOPT\_HTTPAUTH(3)](/CURLOPT_HTTPAUTH/3.md)*. For authentication with a proxy, see *[CURLOPT\_PROXYAUTH(3)](/CURLOPT_PROXYAUTH/3.md)*. - CURLAUTH\_BASIC HTTP Basic authentication. This is the default choice, and the only method that is in wide-spread use and supported virtually everywhere. This sends the username and password over the network in plain text, easily captured by others. - CURLAUTH\_DIGEST HTTP Digest authentication. Digest authentication is defined in RFC 2617 and is a more secure way to do authentication over public networks than the regular old-fashioned Basic method. - CURLAUTH\_DIGEST\_IE The IE-specific Digest authentication behavior is no longer supported. This bit is kept for compatibility and is treated as CURLAUTH\_DIGEST. - CURLAUTH\_BEARER HTTP Bearer token authentication, used primarily in OAuth 2.0 protocol. You can set the Bearer token to use with *[CURLOPT\_XOAUTH2\_BEARER(3)](/CURLOPT_XOAUTH2_BEARER/3.md)*. - CURLAUTH\_NEGOTIATE HTTP Negotiate (SPNEGO) authentication. Negotiate authentication is defined in RFC 4559 and is the most secure way to perform authentication over HTTP. You need to build libcurl with a suitable GSS-API library or SSPI on Windows for this to work. - CURLAUTH\_NTLM HTTP NTLM authentication. A proprietary protocol invented and used by Microsoft. It uses a challenge-response and hash concept similar to Digest, to prevent the password from being eavesdropped. NTLM uses weak cryptographic algorithms and is not considered secure. - CURLAUTH\_NTLM\_WB Support for this is removed since libcurl 8.8.0. NTLM delegating to winbind helper. Authentication is performed by a separate binary application that is executed when needed. The name of the application is specified at compile time but is typically **/usr/bin/ntlm\_auth**. Note that libcurl forks when necessary to run the winbind application and kill it when complete, calling **waitpid()** to await its exit when done. On POSIX operating systems, killing the process causes a SIGCHLD signal to be raised (regardless of whether *[CURLOPT\_NOSIGNAL(3)](/CURLOPT_NOSIGNAL/3.md)* is set), which must be handled intelligently by the application. In particular, the application must not unconditionally call wait() in its SIGCHLD signal handler to avoid being subject to a race condition. This behavior is subject to change in future versions of libcurl. - CURLAUTH\_ANY This is a convenience macro that sets all bits and thus makes libcurl pick any it finds suitable. libcurl automatically selects the one it finds most secure. - CURLAUTH\_ANYSAFE This is a convenience macro that sets all bits except Basic and thus makes libcurl pick any it finds suitable. libcurl automatically selects the one it finds most secure. - CURLAUTH\_ONLY This is a meta symbol. OR this value together with a single specific auth value to force libcurl to probe for unrestricted auth and if not, only that single auth algorithm is acceptable. - CURLAUTH\_AWS\_SIGV4 provides AWS V4 signature authentication on HTTPS header see *[CURLOPT\_AWS\_SIGV4(3)](/CURLOPT_AWS_SIGV4/3.md)*. - CURLAUTH\_HTTPSIG provides RFC 9421 HTTP Message Signatures on outgoing requests, see *[CURLOPT\_HTTPSIG\_ALGORITHM(3)](/CURLOPT_HTTPSIG_ALGORITHM/3.md)*. ## DEFAULT CURLAUTH\_BASIC ## PROTOCOLS This functionality affects http only ## EXAMPLE ``` int main(void) { CURL *curl = curl_easy_init(); if(curl) { CURLcode result; curl_easy_setopt(curl, CURLOPT_URL, "https://example.com/"); /* allow whatever auth the server speaks */ curl_easy_setopt(curl, CURLOPT_HTTPAUTH, CURLAUTH_ANY); curl_easy_setopt(curl, CURLOPT_USERPWD, "james:bond"); result = curl_easy_perform(curl); } } ``` ## HISTORY CURLAUTH\_DIGEST\_IE was added in 7.19.3 CURLAUTH\_ONLY was added in 7.21.3 CURLAUTH\_NTLM\_WB was added in 7.22.0 **CURLAUTH\_**\* macros became *long* types in 7.26.0, prior to this version a *long* cast was necessary when passed to *[curl\_easy\_setopt(3)](/curl_easy_setopt/3.md)*. CURLAUTH\_BEARER was added in 7.61.0 CURLAUTH\_AWS\_SIGV4 was added in 7.74.0 CURLAUTH\_DIGEST\_IE does nothing since 8.21.0 CURLAUTH\_HTTPSIG was added in 8.22.0 ## AVAILABILITY Added in curl 7.10.6 ## RETURN VALUE *[curl\_easy\_setopt(3)](/curl_easy_setopt/3.md)* returns a CURLcode indicating success or error. CURLE\_OK (0) means everything was OK, non-zero means an error occurred, see *[libcurl-errors(3)](/libcurl-errors/3.md)*. ## SEE ALSO [**CURLOPT\_PASSWORD**(3)](/CURLOPT_PASSWORD/3.md), [**CURLOPT\_PROXYAUTH**(3)](/CURLOPT_PROXYAUTH/3.md), [**CURLOPT\_USERNAME**(3)](/CURLOPT_USERNAME/3.md)