How to safely pass secret information in a REST API request to obtain an authentication token?

For secure transmission of secret information when requesting an authentication token via REST API, it is recommended to:

• Use HTTPS to encrypt all traffic between the client and server.
• Transmit secret data (such as login and password or keys) in the body of a POST request, not in the URL, to prevent them from appearing in logs and browser history.
• Use standard authentication methods, such as OAuth 2.0, where secrets are transmitted in headers or request body.
• If necessary, employ additional measures, such as HMAC signatures or temporary tokens.

Example of a request using Basic Authentication (in the header):

String credentials = username + ":" + password;
String encodedCredentials = Base64.getEncoder().encodeToString(credentials.getBytes(StandardCharsets.UTF_8));

HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://api.example.com/auth/token"))
    .header("Authorization", "Basic " + encodedCredentials)
    .POST(HttpRequest.BodyPublishers.noBody())
    .build();

The main thing is to always use a secure connection (HTTPS) and avoid transmitting secrets in URLs or in plain text.