Add Auth Headers to Python API Requests

When you call an API that requires authentication, you need to send credentials with each request. Adding authentication headers to Python requests is straightforward with the requests library. This guide shows you how to add common auth headers—Bearer tokens, Basic auth, and custom API keys—and how to handle them securely.

What You’ll Need

• Python 3.6 or newer installed
• The requests library installed (pip install requests)
• An API endpoint that requires authentication
• Your credentials (API key, token, or username/password)

Step-by-Step

1. Install the requests library if you haven’t already. Open your terminal and run pip install requests.
2. Import the requests module at the top of your Python script:
   import requests
3. Choose your authentication type. The most common are:
   • Bearer token (used by OAuth 2.0 and many modern APIs)
   • Basic auth (username and password)
   • Custom API key (a simple header like X-API-Key)
4. Add a Bearer token header. Create a dictionary with the Authorization header:
   headers = {"Authorization": "Bearer YOUR_TOKEN_HERE"}
   Then pass it to the request:
   response = requests.get("https://api.example.com/data", headers=headers)
5. Use Basic auth. Instead of manually encoding, use the auth parameter:
   response = requests.get("https://api.example.com/data", auth=("username", "password"))
   Requests will automatically encode it as a Basic auth header.
6. Add a custom API key header. Many APIs expect a header like X-API-Key or api_key. Add it to your headers dict:
   headers = {"X-API-Key": "your_api_key_here"}
   Then pass it as above.
7. Combine multiple headers. You can include other headers like Content-Type in the same dict:
   headers = {"Authorization": "Bearer token", "Content-Type": "application/json"}
8. Make the request and check the response. Always check response.status_code. A 200 or 201 means success. If you get 401 or 403, your auth is wrong or missing.
9. Handle the response. Use response.json() if the API returns JSON, or response.text for raw content.

Common Mistakes

• Hardcoding credentials in your script. This is a security risk. Use environment variables or a config file that is not committed to version control.
• Using the wrong header name. Some APIs use Authorization, others use X-API-Key, still others use token. Check the API documentation.
• Forgetting the word “Bearer” before the token. Most OAuth APIs require it exactly as shown.
• Not setting Content-Type when sending JSON. Many APIs require Content-Type: application/json for POST/PUT requests.
• Mixing up Basic auth with Bearer. Basic auth uses the auth parameter, not a manual header (unless you want to encode it yourself, which is error-prone).
• Using HTTP instead of HTTPS when sending credentials. Always use HTTPS to avoid exposing tokens in transit.

Tips

• Use environment variables for secrets. For example: import os; token = os.environ.get("API_TOKEN")
• Create a session if you make multiple requests. It reuses the connection and can store headers:
  session = requests.Session()
session.headers.update({"Authorization": "Bearer token"})
  Then use session.get(...).
• Use a .env file with the python-dotenv package to manage secrets locally.
• Log the response status to debug quickly: print(response.status_code)
• Test with a simple endpoint like https://httpbin.org/bearer to verify your headers work before hitting a real API.

Troubleshooting

If your request fails, follow these steps:

1. Check the status code. 401 means unauthorized—your token is missing, invalid, or expired. 403 means forbidden—you don’t have permission even with valid auth.
2. Verify the header format. Print your headers before sending: print(headers). Make sure there are no typos or extra spaces.
3. Check the API documentation for the exact header name and value format. Some APIs use lowercase, some use a different scheme.
4. Ensure your token hasn’t expired. Many tokens are valid for a limited time. Refresh it if needed.
5. Test with curl to isolate the problem. For example: curl -H "Authorization: Bearer token" https://api.example.com/data. If curl works but Python doesn’t, the issue is in your code.
6. Check for redirects. If the API redirects, the headers might be stripped. Use allow_redirects=False to see what happens.
7. Check for proxies or firewalls that might block or modify your request.

Frequently Asked Questions

How do I add multiple authentication headers?

Just include all headers in the same dictionary. For example: headers = {"Authorization": "Bearer token", "X-API-Key": "key"}. Pass that dict to the request.

What is the difference between Basic auth and Bearer token?

Basic auth uses a username and password (or API key as username) encoded in base64. Bearer tokens are usually generated by an OAuth flow and are more secure because they can be revoked and have an expiry.

Can I use the auth parameter for Bearer tokens?

No, the auth parameter is for Basic auth. For Bearer tokens, you must set the Authorization header manually.

Is it safe to put tokens in the URL?

No. URLs are logged in server logs and browser history. Always put tokens in headers, never in the URL string.

How do I refresh an expired token automatically?

You can catch a 401 response and then call a refresh endpoint to get a new token, then retry the original request. This requires implementing a token refresh logic in your code.

What if the API expects the token in a cookie?

Some APIs use cookies for authentication. You can use a session and set the cookie via session.cookies.set("name", "value") or let the session handle it from a login response.

Related

• Comodo Antivirus Firewall: What to Know
• Human Oversight for AI Database Operations
• Filter and Exclude Columns: How-To Guide