This isn't a problem specifically with HTTP basic which at the end of the day is just a HTTP request header with an encoded string. If you're using basic auth

This isn't a problem specifically with HTTP basic which at the end of the day is just a HTTP request header with an encoded string. If you're using basic auth and a long random server generated key as Stripe does instead of a user supplied pasword performance is a non issue as you'd SHA2 it in your DB not bcrypt.