# HTTP authentication with Basic Auth and OAuth2

*MuleSoft Developer II Study Guide · Secure data at rest and in transit · Last updated November 7, 2026 · https://www.certifyforce.com/study-guide/mulesoft-developer-ii/secure-data-at-rest-and-in-transit/http-authentication-with-basic-auth-and-oauth2*

Configure Basic authentication and OAuth grants for HTTP clients, map token response formats, and manage renewal, callback transport and token-manager contexts.

- Certification: Salesforce MuleSoft Developer II
- Exam section: Secure data at rest and in transit
- Study guide: https://www.certifyforce.com/study-guide/mulesoft-developer-ii

**Official exam objective:**

> Implement API invocations authenticated by Basic Auth or OAuth2 with HTTP or REST connectors.

## What the exam expects

- Configure Basic authentication and its challenge behavior on HTTP Request.
- Assign OAuth authorization, callback and token endpoints to their actual roles.
- Match token extraction and refresh conditions to the provider contract.
- Manage stored OAuth information without confusing local context with remote revocation.

Key terms: a **grant** is an authorization method; a **token endpoint** issues credentials; a **callback** receives the authorization result; an **extractor** reads token-response fields; a **token manager** stores an OAuth context.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Basic challenge | Preemptive controls whether the initial request carries credentials. | [HTTP reference](https://raw.githubusercontent.com/mulesoft/docs-connectors/33276ccdb80668dd8bd45102a529a5fcc0918eea/http/1.9/modules/ROOT/pages/http-documentation.adoc) |
| Local initiation | Local Authorization Url starts user authorization in Mule. | [OAuth reference](https://raw.githubusercontent.com/mulesoft/docs-connectors/e670e4fa926b805cff09b3a6d377a92bc4a6bb12/oauth/1.1/modules/ROOT/pages/oauth-module-reference.adoc) |
| Callback reuse | Supply both listener configuration and callback path. | [OAuth reference](https://raw.githubusercontent.com/mulesoft/docs-connectors/e670e4fa926b805cff09b3a6d377a92bc4a6bb12/oauth/1.1/modules/ROOT/pages/oauth-module-reference.adoc) |
| Scope syntax | The connector field uses a comma-separated string. | [HTTP authentication](https://raw.githubusercontent.com/mulesoft/docs-connectors/33276ccdb80668dd8bd45102a529a5fcc0918eea/http/1.9/modules/ROOT/pages/http-authentication.adoc) |
| Token shape | Match content interpretation and selector to the provider. | [HTTP authentication](https://raw.githubusercontent.com/mulesoft/docs-connectors/33276ccdb80668dd8bd45102a529a5fcc0918eea/http/1.9/modules/ROOT/pages/http-authentication.adoc) |
| Renewal boundary | Refresh predicates inspect the protected-call response. | [OAuth reference](https://raw.githubusercontent.com/mulesoft/docs-connectors/e670e4fa926b805cff09b3a6d377a92bc4a6bb12/oauth/1.1/modules/ROOT/pages/oauth-module-reference.adoc) |
| Client initialization | Token acquisition is attempted during deployment. | [HTTP authentication](https://raw.githubusercontent.com/mulesoft/docs-connectors/33276ccdb80668dd8bd45102a529a5fcc0918eea/http/1.9/modules/ROOT/pages/http-authentication.adoc) |
| Owner invalidation | Select the actual manager and intended owner context. | [OAuth reference](https://raw.githubusercontent.com/mulesoft/docs-connectors/e670e4fa926b805cff09b3a6d377a92bc4a6bb12/oauth/1.1/modules/ROOT/pages/oauth-module-reference.adoc) |

## Check yourself

- Why must an expiry diagnostic avoid assuming the same duration across providers?
- When a contract test inspects Retrieve Expires In, which documented output type should it expect?
- What does Output Mime Type describe on an OAuth retrieval operation?

## Sources

- [HTTP authentication, HTTP 1.9 baseline](https://raw.githubusercontent.com/mulesoft/docs-connectors/33276ccdb80668dd8bd45102a529a5fcc0918eea/http/1.9/modules/ROOT/pages/http-authentication.adoc)
- [HTTP Connector 1.9 Reference](https://raw.githubusercontent.com/mulesoft/docs-connectors/33276ccdb80668dd8bd45102a529a5fcc0918eea/http/1.9/modules/ROOT/pages/http-documentation.adoc)
- [OAuth Module 1.1 Reference](https://raw.githubusercontent.com/mulesoft/docs-connectors/e670e4fa926b805cff09b3a6d377a92bc4a6bb12/oauth/1.1/modules/ROOT/pages/oauth-module-reference.adoc)
- [DataWeave 2.6 read](https://docs.mulesoft.com/dataweave/2.6/dw-core-functions-read)
- [DataWeave 2.6 selectors](https://docs.mulesoft.com/dataweave/2.6/dataweave-selectors)
- [TLS Configuration, Mule 4.6](https://docs.mulesoft.com/mule-runtime/4.6/tls-configuration)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 12 linked practice questions, and unlimited timed mock exams are included with the MuleSoft Developer II pack (USD $19): https://www.certifyforce.com/practice-exams