# Basic Authentication Plugin **URL:** \ **Category:** Questions\ **Created:** [November 27, 2017, 11:44pm UTC](https://discuss.konghq.com/t/basic-authentication-plugin/36 "2017-11-27T23:44:24Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![CaesarKing](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/caesarking/32/36_2.png) [@CaesarKing](https://discuss.konghq.com/u/CaesarKing)\ **Post date:** [November 27, 2017, 11:44pm UTC](https://discuss.konghq.com/t/basic-authentication-plugin/36/1 "2017-11-27T23:44:24Z")
The Basic Authentication plugin adds username and password protection to your APIs. Give it a try and discuss it here! [Basic Authentication plugin documentation](https://getkong.org/plugins/basic-authentication) ---
**Author:** ![QiQe\_Garbi](https://avatars.discourse-cdn.com/v4/letter/q/b5a626/32.png) [@QiQe\_Garbi](https://discuss.konghq.com/u/QiQe_Garbi)\ **Post date:** [December 8, 2017, 8:47pm UTC](https://discuss.konghq.com/t/basic-authentication-plugin/36/2 "2017-12-08T20:47:14Z")
Hi Guys, is it possible to update credentials (username or password) without needing to delete a consumer? ---
**Author:** ![thibaultcha](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/thibaultcha/32/340_2.png) [@thibaultcha](https://discuss.konghq.com/u/thibaultcha)\ **Post date:** [December 9, 2017, 3:40am UTC](https://discuss.konghq.com/t/basic-authentication-plugin/36/3 "2017-12-09T03:40:26Z")
@QiQe_Garbi Hi, Definitely. The Admin API follows RESTful practices; the following endpoint accepts `GET` as well as `PATCH` requests: ```auto /consumers/{consumer id or username}/basic-auth/{credential username or id} ``` Example: ```auto $ curl -X PATCH \ --url http://kong:8001/consumers/bob/basic-auth/55283d7e-dc92-11e7-b1fe-0fb516a46133 \ -d "username=alice" \ -d "password=new_password" ``` ---
**Author:** ![QiQe\_Garbi](https://avatars.discourse-cdn.com/v4/letter/q/b5a626/32.png) [@QiQe\_Garbi](https://discuss.konghq.com/u/QiQe_Garbi)\ **Post date:** [December 9, 2017, 9:17pm UTC](https://discuss.konghq.com/t/basic-authentication-plugin/36/4 "2017-12-09T21:17:23Z")
Thanks @thibaultcha , I was trying the same but with a missing consumer at the end. Is that info in your docs? I couldn’t find it ---
**Author:** ![Cooper](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/cooper/32/9_2.png) [@Cooper](https://discuss.konghq.com/u/Cooper)\ **Post date:** [December 9, 2017, 10:01pm UTC](https://discuss.konghq.com/t/basic-authentication-plugin/36/5 "2017-12-09T22:01:53Z")
Hi @QiQe_Garbi - indeed you noticed that our docs at [https://getkong.org/plugins/basic-authentication](https://getkong.org/plugins/basic-authentication) don’t explicitly describe PATCHing - sorry about that! We welcome Pull Requests to improve Kong’s documentation - see [https://github.com/Kong/getkong.org](https://github.com/Kong/getkong.org) ---
**Author:** ![gentunian](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/gentunian/32/488_2.png) [@gentunian](https://discuss.konghq.com/u/gentunian)\ **Post date:** [August 15, 2018, 4:23am UTC](https://discuss.konghq.com/t/basic-authentication-plugin/36/6 "2018-08-15T04:23:23Z")
Is there a way to configure a service to use basic auth on downstreams only? For example, you may want integrate an API that uses basic auth with kong but avoid using basic auth in the exposed service in kong. This way: 1. API endpoint [https://my.example.com/api/v1/foo](https://my.example.com/api/v1/foo) has basic auth already enabled 2. Create a Kong service at [https://my.kong.com/example](https://my.kong.com/example) that proxies request with basic auth 3. Optionally, create consumers and secure the kong service with any kind of authentication (even none). ---
**Author:** ![Cooper](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/cooper/32/9_2.png) [@Cooper](https://discuss.konghq.com/u/Cooper)\ **Post date:** [August 16, 2018, 4:50pm UTC](https://discuss.konghq.com/t/basic-authentication-plugin/36/7 "2018-08-16T16:50:00Z")
Hi @gentunian - I think you may be getting no replies on your post because it is hard to understand what problem you are trying to solve (I know I can’t understand it!). Can you try to clarify? ---
**Author:** ![gentunian](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/gentunian/32/488_2.png) [@gentunian](https://discuss.konghq.com/u/gentunian)\ **Post date:** [August 18, 2018, 2:42pm UTC](https://discuss.konghq.com/t/basic-authentication-plugin/36/8 "2018-08-18T14:42:51Z")
hey there @Cooper, thanks for the suggestion. I was wondering if it was possible to use basic auth plugin only in the forwarding request to the APIs endpoints. I will try to clarify: # tl;dr - an API that uses basic authentication at [https://foo.api.com/v1/some/REST/path](https://foo.api.com/v1/some/REST/path) - Kong Api Manager that will route requests to that endpoint at [https://kong.example.com/foo](https://kong.example.com/foo) - Add any authorization for that kong service and proxy the request to the API with a hardcoded basic auth This way, kong service is using basic auth **only** on downstreams and using any auth up front. # example To consume/use the API you will do something like: ``` curl -H 'Authorizaction: Basic Ajasfualshfna=' https://foo.api.com/v1/some/REST/path ``` Now, you want to use your API through Kong and possibly with another auth or maybe just none. That would be: ``` # use kong with key-auth plugin and kong will check the # consumer api key for that service and then proxy the request # to the API with the adequate Authorization header. curl -H 'My-Key: jehOahYd821Asna' https://kong.example.com/foo ``` Something like: ![foo](https://canada1.discourse-cdn.com/flex036/uploads/konghq/original/1X/64f5248512121731bf33cdc81a7d73113a466502.jpeg) ---
**Author:** ![thibaultcha](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/thibaultcha/32/340_2.png) [@thibaultcha](https://discuss.konghq.com/u/thibaultcha)\ **Post date:** [August 20, 2018, 4:30am UTC](https://discuss.konghq.com/t/basic-authentication-plugin/36/9 "2018-08-20T04:30:33Z")
Hi, It seems to me like you are describing the use case solved by this plugin: > **[mvanholsteijn/kong-plugin-upstream-basic-auth](https://github.com/mvanholsteijn/kong-plugin-upstream-basic-auth)** > > A Kong API Gateway plugin for inserting a basic authentication header per consumer to the upstream service - mvanholsteijn/kong-plugin-upstream-basic-auth I hope it answers addresses your use-case 🙂 PS: This plugin is maintained by a community member, so if you have issues or questions with it, please open an issue in the repository, as there is nothing we can do to assist. ---
**Author:** ![gentunian](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/gentunian/32/488_2.png) [@gentunian](https://discuss.konghq.com/u/gentunian)\ **Post date:** [August 20, 2018, 8:19pm UTC](https://discuss.konghq.com/t/basic-authentication-plugin/36/10 "2018-08-20T20:19:14Z")
thanks @thibaultcha seems that also it could be done with [request transformer plugin](https://docs.konghq.com/plugins/request-transformer/)