# RESTful authentication (/en/api-reference/api-ref/rtc/authentication)

> For AI agents: see the complete documentation index at [llms.txt](/llms.txt).

RTC REST APIs require Basic HTTP authentication. Generate a Base64-encoded credential with the customer ID and customer secret provided by Agora, then pass the credential in the `Authorization` request header.

<CalloutContainer type="info">
  <CalloutDescription>
    Implement authentication on your server to reduce the risk of credential leakage.
  </CalloutDescription>
</CalloutContainer>

## Generate a customer ID and customer secret [#generate-a-customer-id-and-customer-secret]

1. In [Agora Console](https://console.agora.io), click **Developer Toolkit** > **RESTful API**.
2. Click **Add a secret**, then click **OK**. Agora generates a customer ID and customer secret.
3. Click **Download** in the **Customer Secret** column. Read the prompt carefully and save the downloaded `key_and_secret.txt` file in a secure location.
4. Use the customer ID and customer secret to generate a Base64-encoded credential, then pass it to the `Authorization` request header.

You can download the customer secret from Agora Console only once. Keep it secure.

## Authorization header [#authorization-header]

Concatenate the customer ID and customer secret with a colon, encode the result with Base64, then prefix it with `Basic`.

```text
Authorization: Basic <base64(customer_id:customer_secret)>
```

For testing and debugging, you can use a Basic Auth header generator. Enter the customer ID as the username and the customer secret as the password.

## Basic authentication examples [#basic-authentication-examples]

The following examples send a request to get all projects under your Agora account.

<CodeBlockTabs defaultValue="curl">
  <CodeBlockTabsList>
    <CodeBlockTabsTrigger value="curl">
      cURL
    </CodeBlockTabsTrigger>

    <CodeBlockTabsTrigger value="nodejs">
      Node.js
    </CodeBlockTabsTrigger>

    <CodeBlockTabsTrigger value="python">
      Python
    </CodeBlockTabsTrigger>
  </CodeBlockTabsList>

  <CodeBlockTab value="curl">
    ```bash
    customer_key="Your customer ID"
    customer_secret="Your customer secret"
    authorization=$(printf "%s:%s" "$customer_key" "$customer_secret" | base64)

    curl --request GET 'https://api.agora.io/dev/v1/projects' \
      --header "Authorization: Basic $authorization" \
      --header 'Content-Type: application/json'
    ```
  </CodeBlockTab>

  <CodeBlockTab value="nodejs">
    ```js
    const https = require('https');

    const customerKey = 'Your customer ID';
    const customerSecret = 'Your customer secret';
    const encodedCredential = Buffer.from(
      `${customerKey}:${customerSecret}`,
    ).toString('base64');

    const req = https.request(
      {
        hostname: 'api.agora.io',
        port: 443,
        path: '/dev/v1/projects',
        method: 'GET',
        headers: {
          Authorization: `Basic ${encodedCredential}`,
          'Content-Type': 'application/json',
        },
      },
      (res) => {
        console.log(`Status code: ${res.statusCode}`);
        res.on('data', (chunk) => process.stdout.write(chunk));
      },
    );

    req.on('error', console.error);
    req.end();
    ```
  </CodeBlockTab>

  <CodeBlockTab value="python">
    ```python
    import base64
    import http.client

    customer_key = "Your customer ID"
    customer_secret = "Your customer secret"
    credential = base64.b64encode(
        f"{customer_key}:{customer_secret}".encode("utf-8")
    ).decode("utf-8")

    conn = http.client.HTTPSConnection("api.agora.io")
    headers = {
        "Authorization": f"Basic {credential}",
        "Content-Type": "application/json",
    }

    conn.request("GET", "/dev/v1/projects", "", headers)
    res = conn.getresponse()
    print(res.read().decode("utf-8"))
    ```
  </CodeBlockTab>
</CodeBlockTabs>