CF7 Bearer Token vs API Key vs Basic Auth: When to Use Which

The article <source>5ebc4064-02d</source> discusses the three methods for configuring authentication when sending data from Contact Form 7 to an external API: Basic Auth, API Key, and Bearer Token. The choice of method depends entirely on the expectations of the target API.

Basic Auth involves encoding a username and password in Base64 and including it in the request header. It is simple and works well for legacy systems or quick testing, but it is not inherently secure as the credentials are not encrypted and can be easily intercepted.

API Key is a static token that identifies an application or account. It can be passed in various ways, such as an Authorization header, custom header, or query parameter. API keys are common for internal APIs and simple integrations but provide authorization without verifying user identity. Store API keys securely in environment variables or configuration files.

Bearer Token is the most common method for modern APIs, typically using JSON Web Tokens (JWT) or OAuth 2.0 access tokens. The token is obtained from the API's authentication endpoint and included in the Authorization header as "Bearer your-token-here". Bearer tokens are standard for OAuth 2.0 flows and are more secure than static API keys, as they expire and require refreshing. However, this method is more complex to implement and may require additional configuration.

The article recommends checking the API documentation to determine the required authentication method. It suggests starting with the simplest method if debugging, then upgrading to a more secure method if needed. Configuring authentication in the plugin involves manually inputting the appropriate header or token in the provided fields.