HTTP Basic is the oldest, simplest scheme: the client puts base64(user:password) in the Authorization header on every request. No sessions, no tokens, no ceremony. Fine for internal tools over HTTPS — never for public apps.
1GET /api/me HTTP/1.12Host: api.example.com3Authorization: Basic YWxpY2U6czNjcmV0
Base64 is encoding, not encryption. Anyone who sees the header can decode it in one line of code — atob("YWxpY2U6czNjcmV0"). That's why HTTPS is non-negotiable.