> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/ably/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Basic Authentication

Basic authentication is the simplest way to authenticate with Ably. It requires passing an [API key](/docs/pubsub/auth/overview#api-keys) when instantiating an SDK.

<Aside data-type="important">
  Private API keys should never be shared with untrusted parties, and as such, should only be used by your trusted secure servers when authenticating with Ably.
</Aside>

## How to use basic authentication

The following is an example of using basic authentication:

<Code>
  ```realtime_javascript theme={null}
  const realtime = new Ably.Realtime({
    key: '{{API_KEY}}'
  });
  ```

  ```rest_javascript theme={null}
  const rest = new Ably.Rest({ key: '{{API_KEY}}' });
  ```

  ```realtime_nodejs theme={null}
  const realtime = new Ably.Realtime({
    key: '{{API_KEY}}'
  });
  ```

  ```rest_nodejs theme={null}
  const rest = new Ably.Rest({ key: '{{API_KEY}}' });
  ```

  ```realtime_ruby theme={null}
  realtime = Ably::Realtime.new(key: '{{API_KEY}}')
  ```

  ```rest_ruby theme={null}
  rest = Ably::Rest.new(key: '{{API_KEY}}')
  ```

  ```realtime_python theme={null}
  realtime = AblyRealtime(key='{{API_KEY}}')
  ```

  ```rest_python theme={null}
  rest = AblyRest(key='{{API_KEY}}')
  ```

  ```realtime_java theme={null}
  ClientOptions options = new ClientOptions();
  options.key = "{{API_KEY}}";
  AblyRealtime realtime = new AblyRealtime(options);
  ```

  ```rest_java theme={null}
  ClientOptions options = new ClientOptions();
  options.key = "{{API_KEY}}";
  AblyRest rest = new AblyRest(options);
  ```

  ```realtime_swift theme={null}
  let realtime = ARTRealtime(key: "{{API_KEY}}")
  ```

  ```rest_swift theme={null}
  let rest = ARTRest(key: "{{API_KEY}}")
  ```

  ```realtime_objc theme={null}
  ARTRealtime *realtime = [[ARTRealtime alloc] initWithKey:@"{{API_KEY}}"];
  ```

  ```rest_objc theme={null}
  ARTRest *rest = [[ARTRest alloc] initWithKey:@"{{API_KEY}}"];
  ```

  ```realtime_csharp theme={null}
  AblyRealtime realtime = new AblyRealtime("{{API_KEY}}");
  ```

  ```rest_csharp theme={null}
  AblyRest rest = new AblyRest("{{API_KEY}}");
  ```

  ```realtime_go theme={null}
  client, err := ably.NewRealtime(ably.WithKey("{{API_KEY}}"))
  ```

  ```rest_go theme={null}
  client, err := ably.NewREST(ably.WithKey("{{API_KEY}}"))
  ```

  ```realtime_flutter theme={null}
  final clientOptions = ably.ClientOptions(
    key: '{{API_KEY}}'
  );
  final realtime = ably.Realtime(options: clientOptions);
  ```

  ```rest_flutter theme={null}
  final clientOptions = ably.ClientOptions(
    key: '{{API_KEY}}'
  );
  ably.Rest rest = ably.Rest(options: clientOptions);
  ```

  ```rest_php theme={null}
  $rest = new Ably\AblyRest(['key' => '{{API_KEY}}']);
  ```
</Code>

## When to use basic authentication

Ably recommends that basic authentication is only used server-side because of the following potential issues:

* The secret is passed directly by the client to Ably, so it is only permitted for connections that are over TLS, to prevent the key secret being intercepted.
* All of the configured [capabilities](/docs/auth/capabilities) of the key are implicitly possible in any request, and clients that legitimately obtain this key may then abuse the rights for that key.
* A client that authenticates using an API key can claim any client ID it chooses. Therefore this client ID cannot be trusted to represent the genuine identity of the client. Client IDs should be assigned by the server, once the client's credentials have been authenticated.

<Aside data-type="note">
  When selecting an Ably SDK for implementing basic authentication with Ably, you don't need to use the realtime interface.

  As basic authentication is primarily designed for authenticating a secure server, it is more efficient to use the REST interface of an Ably SDK. This is because the overhead associated with maintaining a realtime connection is not required. However, this is only true when the server is used solely for authentication.
</Aside>

## Next steps

* Learn about [token authentication](/docs/pubsub/auth/token) for client-side apps
* Understand [capabilities](/docs/auth/capabilities) for access control
* Explore [identified clients](/docs/auth/identified-clients)