And if you also pass an Authorization header it just drops the basic auth header (tested against a mirror server): $ curl http://user:pass@localhost:8080

And if you also pass an Authorization header it just drops the basic auth header (tested against a mirror server): $ curl http://user:pass@localhost:8080 GET / HTTP/1.1 Host: localhost:8080 User-Agent: curl/7.79.1 Accept: */* Authorization: Basic dXNlcjpwYXNz $ curl -H 'Authorization: Token blobbity' http://user:pass@localhost:8080 GET / HTTP/1.1 Host: localhost:8080 User-Agent: curl/7.79.1 Accept: */* Authorization: Token blobbity