In this article I would present a discussion on implementing HTTP authentication in Web API with code examples to illustrate the concepts discussed.

Access codes sent by SMS or authenticator apps can be bypassed by clever phishing. Hardware-based tokens make that harder to do.