base64clientidclientsecret

Base64 client id client secret refers to the common practice of encoding a client's identifier and secret together using Base64 so they can be transmitted as a single credential in HTTP requests. In OAuth 2.0 and related API protocols, many token endpoints accept client credentials either in the Authorization header using the Basic scheme or, less commonly, in the form body. The typical format to encode is the string client_id:client_secret, encoded as Base64.

To use it, the client prepares the credentials by concatenating the client_id, a colon, and the client_secret, encodes the result with Base64, and sends the value in the Authorization header as Basic followed by the encoded string. For example: Authorization: Basic <base64_of_client_id_colon_client_secret>. Some servers also allow sending client_id and client_secret in the request body as form-encoded parameters, though this is less secure if HTTPS is not used and may be disallowed by the provider.

Important cautions: Base64 is an encoding, not encryption. Anyone who can read the transport can decode it. Always use TLS (HTTPS), avoid logging the header, and protect client secrets at rest. If possible, use short-lived credentials and rotate secrets. Public clients should use appropriate flows (such as PKCE) to reduce risk.

Standards notes: The approach is described in OAuth 2.0 (RFC 6749), including confidentiality considerations and alternatives for client authentication (e.g., Basic vs form-encoded).