 <h3>Header Authentication</h3> <p>there are three ways to do it</p> <ol> <li>HTTP Basic Authentication</li> <li>HTTP Digest Authentication</li> <li>Roll our own using custom HTTP headers</li> </ol> <p>You can read more from <a href="http://php.net/manual/en/features.http-auth.php" rel="nofollow">PHP Manual</a></p> <p>Restler 1.0 had a Digest Authentication example. I've modified to make it work with Restler 2.0</p> <pre><code>class DigestAuthentication implements iAuthenticate { public $realm = 'Restricted API'; public static $user; public $restler; public function __isAuthenticated() { //user =&gt; password hardcoded for convenience $users = array('admin' =&gt; 'mypass', 'guest' =&gt; 'guest'); if (empty($_SERVER['PHP_AUTH_DIGEST'])) { header('HTTP/1.1 401 Unauthorized'); header('WWW-Authenticate: Digest realm="'.$this-&gt;realm.'",qop="auth",nonce="'. uniqid().'",opaque="'.md5($this-&gt;realm).'"'); throw new RestException(401, 'Digest Authentication Required'); } // analyze the PHP_AUTH_DIGEST variable if (!($data = DigestAuthentication::http_digest_parse($_SERVER['PHP_AUTH_DIGEST'])) || !isset($users[$data['username']])) { throw new RestException(401, 'Wrong Credentials!'); } // generate the valid response $A1 = md5($data['username'] . ':' . $this-&gt;realm . ':' . $users[$data['username']]); $A2 = md5($_SERVER['REQUEST_METHOD'].':'.$data['uri']); $valid_response = md5($A1.':'.$data['nonce'].':'.$data['nc'].':'.$data['cnonce'].':'.$data['qop'].':'.$A2); if ($data['response'] != $valid_response) { throw new RestException(401, 'Wrong Credentials!'); } // ok, valid username &amp; password DigestAuthentication::$user=$data['username']; return true; } /** * Logs user out of the digest authentication by bringing the login dialog again * ignore the dialog to logout * * @url GET /user/login * @url GET /user/logout */ public function logout() { header('HTTP/1.1 401 Unauthorized'); header('WWW-Authenticate: Digest realm="'.$this-&gt;realm.'",qop="auth",nonce="'. uniqid().'",opaque="'.md5($this-&gt;realm).'"'); die('Digest Authorisation Required'); } // function to parse the http auth header private function http_digest_parse($txt) { // protect against missing data $needed_parts = array('nonce'=&gt;1, 'nc'=&gt;1, 'cnonce'=&gt;1, 'qop'=&gt;1, 'username'=&gt;1, 'uri'=&gt;1, 'response'=&gt;1); $data = array(); $keys = implode('|', array_keys($needed_parts)); preg_match_all('@(' . $keys . ')=(?:([\'"])([^\2]+?)\2|([^\s,]+))@', $txt, $matches, PREG_SET_ORDER); foreach ($matches as $m) { $data[$m[1]] = $m[3] ? $m[3] : $m[4]; unset($needed_parts[$m[1]]); } return $needed_parts ? false : $data; } } </code></pre>