What is HTTPBasicAuth?
HTTPBasicAuth encodes a username/password pair for RFC 7617 Basic authentication on outbound CrewAI A2A client calls. CrewAI wires it into A2AClientConfig(auth=...) the same way as bearer or OAuth helpers, but the security properties are weaker: credentials are static, often long-lived, and historically mishandled in logs. Treat it strictly as a bridge to legacy partners that cannot issue OAuth client credentials or signed JWTs yet.
Operational checklist: only enable over HTTPS, rotate passwords through your secret manager (never commit YAML), and scope accounts to read-only automation principals where possible. Pair with network-level allow lists because Basic does not carry proof-of-possession beyond the shared secret.
When the upstream finally supports bearer tokens, migrate by swapping the auth object — keep automation IDs and base URLs stable so you only retest the handshake path.
When to Use
Legacy systems with no other option.
Use Cases
- • Legacy integrations
Key Features
- ✓ Username/password
When NOT to Use
Anywhere modern — use OAuth or bearer tokens.
Notes
TLS is mandatory
Basic sends reversible base64 encoding, not encryption. Plain HTTP exposes credentials to every hop.
Logging hazards
HTTP clients sometimes echo Authorization headers in debug mode. Disable verbose HTTP logs in production.
Rotation playbook
Plan dual-credential cutovers with the partner — Basic lacks refresh tokens, so downtime aligns with password changes.
Prefer BearerTokenAuth or OAuth2ClientCredentials
When the upstream can issue short-lived tokens, migrate off Basic to reduce blast radius of a single leaked string.
Import
from crewai.a2a.auth import HTTPBasicAuthKey Parameters
| Parameter | Type | Default | Purpose |
|---|---|---|---|
| username / password | str | — | Basic-auth pair. |
Code Examples
Wire into A2AClientConfig
import os
from crewai.a2a import A2AClientConfig
from crewai.a2a.auth import HTTPBasicAuth
auth = HTTPBasicAuth(username=os.environ['A2A_BASIC_USER'], password=os.environ['A2A_BASIC_PASS'])
cfg = A2AClientConfig(base_url='https://legacy.partner.example/a2a', auth=auth)Isolate per-environment principals
import os
from crewai.a2a.auth import HTTPBasicAuth
def basic_auth_for(stage: str) -> HTTPBasicAuth:
if stage == 'prod':
return HTTPBasicAuth(username=os.environ['PROD_USER'], password=os.environ['PROD_PASS'])
return HTTPBasicAuth(username=os.environ['STAGE_USER'], password=os.environ['STAGE_PASS'])Never log the auth object
# Bad: logging.info(cfg)
# Good: logging.info({'base_url': cfg.base_url})Common Mistakes
❌ Committing usernames and passwords to git
✅ Load from environment or a secret manager at process start.
HTTPBasicAuth FAQ
What is HTTPBasicAuth in CrewAI?
A2A auth method: HTTP Basic (username + password). Legacy; prefer token-based auth. HTTPBasicAuth encodes a username/password pair for RFC 7617 Basic authentication on outbound CrewAI A2A client calls. CrewAI wires it into A2AClientConfig(auth=...) the same way as bearer or OAuth helpers, but the security properties are weaker: credentials are static, often long-lived, and historically mishandled in logs. Treat it strictly as a bridge to legacy partners that cannot issue OAuth client credentials or signed JWTs yet. Operational checklist: only enable over HT…
Which package defines the CrewAI class HTTPBasicAuth?
DevShelfHub maps HTTPBasicAuth to Python module crewai.a2a.auth (package path crewai.a2a.auth in this reference). Pin your installed crewai version and match imports to the snippet on this page.
When should I use HTTPBasicAuth?
Legacy systems with no other option.
When should I avoid using HTTPBasicAuth?
Anywhere modern — use OAuth or bearer tokens.
How do I import HTTPBasicAuth in Python?
from crewai.a2a.auth import HTTPBasicAuth
Where can I explore more CrewAI API reference pages?
Open the CrewAI API reference index on DevShelfHub to search 58 classes, 30 methods, and 16 decorators, each with runnable examples, parameters, common mistakes, and cross-links.