---
title: "Restrict access to PDF with HTTP basic authentication | Nutrient"
canonical_url: "https://www.nutrient.io/guides/web/open-a-document/secured-documents/http-authenticated/"
md_url: "https://www.nutrient.io/guides/web/open-a-document/secured-documents/http-authenticated.md"
last_updated: "2026-05-20T19:49:34.899Z"
description: "Sometimes you want to restrict access to your PDFs so they aren't publicly available on the internet. The easiest way to achieve this is with HTTP basic authentication."
---

# Restrict access to PDFs with HTTP basic authentication

Sometimes you want to restrict access to your PDFs so they aren't publicly available on the internet. The easiest way to achieve this is with [HTTP basic authentication](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication#Basic_authentication_scheme).

If you try to load a PDF URL that's protected by HTTP basic authentication, Nutrient will ask you for a username and password. To avoid entering these, you can fetch the PDF yourself, passing the credentials as an `Authorization` header. Once you've received the response, the `load` method accepts the content as an `ArrayBuffer` ([try it in the Playground](https://www.nutrient.io/demo/sandbox?p=eyJ2IjoxLCJzZXR0aW5ncyI6eyJmaWxlTmFtZSI6ImJhc2ljLnBkZiJ9LCJqcyI6ImNvbnNvbGUubG9nKFwiRGVtb25zdHJhdGluZyBIVFRQIEJhc2ljIEF1dGhlbnRpY2F0aW9uIGZvciBQREZzLi4uXCIpO1xuXG5jb25zb2xlLmxvZyhcIlxcbkhUVFAgQmFzaWMgQXV0aCBzY2VuYXJpb3M6XCIpO1xuY29uc29sZS5sb2coXCIxLiBGZXRjaCBQREYgd2l0aCBjcmVkZW50aWFscyBpbiBBdXRob3JpemF0aW9uIGhlYWRlclwiKTtcbmNvbnNvbGUubG9nKFwiMi4gQ29udmVydCByZXNwb25zZSB0byBBcnJheUJ1ZmZlclwiKTtcbmNvbnNvbGUubG9nKFwiMy4gTG9hZCBBcnJheUJ1ZmZlciBkaXJlY3RseSBpbnRvIE51dHJpZW50XCIpO1xuXG5jb25zb2xlLmxvZyhcIlxcbk5vdGU6IFBsYXlncm91bmQgdXNlcyBwdWJsaWMgUERGcywgdGhpcyBkZW1vIHNob3dzIHRoZSBwYXR0ZXJuXCIpO1xuXG5hc3luYyBmdW5jdGlvbiBsb2FkUHJvdGVjdGVkUERGKHVybCwgdXNlcm5hbWUsIHBhc3N3b3JkKSB7XG4gIGNvbnNvbGUubG9nKFwiXFxuRmV0Y2hpbmcgcHJvdGVjdGVkIFBERi4uLlwiKTtcbiAgY29uc29sZS5sb2coXCJVUkw6XCIsIHVybCk7XG4gIGNvbnNvbGUubG9nKFwiVXNlcm5hbWU6XCIsIHVzZXJuYW1lKTtcblxuICBjb25zdCBoZWFkZXJzID0gbmV3IEhlYWRlcnMoKTtcbiAgY29uc3QgZW5jb2RlZENyZWRlbnRpYWxzID0gYnRvYSh1c2VybmFtZSArIFwiOlwiICsgcGFzc3dvcmQpO1xuICBoZWFkZXJzLnNldChcIkF1dGhvcml6YXRpb25cIiwgXCJCYXNpYyBcIiArIGVuY29kZWRDcmVkZW50aWFscyk7XG5cbiAgY29uc29sZS5sb2coXCJBdXRob3JpemF0aW9uIGhlYWRlciBzZXRcIik7XG5cbiAgY29uc3QgcGRmUmVzcG9uc2UgPSBhd2FpdCBmZXRjaCh1cmwsIHsgaGVhZGVycyB9KTtcbiAgY29uc29sZS5sb2coXCJQREYgZmV0Y2hlZCBzdWNjZXNzZnVsbHlcIik7XG5cbiAgY29uc3QgZG9jdW1lbnQgPSBhd2FpdCBwZGZSZXNwb25zZS5hcnJheUJ1ZmZlcigpO1xuICBjb25zb2xlLmxvZyhcIkNvbnZlcnRlZCB0byBBcnJheUJ1ZmZlcjpcIiwgZG9jdW1lbnQuYnl0ZUxlbmd0aCwgXCJieXRlc1wiKTtcblxuICByZXR1cm4gTnV0cmllbnRWaWV3ZXIubG9hZCh7XG4gICAgLi4uYmFzZU9wdGlvbnMsXG4gICAgZG9jdW1lbnRcbiAgfSk7XG59XG5cbmNvbnNvbGUubG9nKFwiXFxuU2ltdWxhdGluZyBwcm90ZWN0ZWQgUERGIGxvYWQgKHVzaW5nIHB1YmxpYyBQREYpLi4uXCIpO1xuXG4vLyBTaW5jZSBwbGF5Z3JvdW5kIGRvZXNuJ3QgaGF2ZSBhIHByb3RlY3RlZCBQREYsIHdlJ2xsIGRlbW9uc3RyYXRlIHdpdGggdGhlIGRlZmF1bHRcbmZldGNoKGJhc2VPcHRpb25zLmRvY3VtZW50KVxuICAudGhlbihyZXNwb25zZSA9PiByZXNwb25zZS5hcnJheUJ1ZmZlcigpKVxuICAudGhlbihhc3luYyAoZG9jdW1lbnQpID0%252BIHtcbiAgICBjb25zb2xlLmxvZyhcIlxcblBERiBmZXRjaGVkIGFzIEFycmF5QnVmZmVyOlwiLCBkb2N1bWVudC5ieXRlTGVuZ3RoLCBcImJ5dGVzXCIpO1xuXG4gICAgY29uc3QgaW5zdGFuY2UgPSBhd2FpdCBOdXRyaWVudFZpZXdlci5sb2FkKHtcbiAgICAgIGNvbnRhaW5lcjogYmFzZU9wdGlvbnMuY29udGFpbmVyLFxuICAgICAgZG9jdW1lbnQsXG4gICAgICBsaWNlbnNlS2V5OiBiYXNlT3B0aW9ucy5saWNlbnNlS2V5LFxuICAgIH0pO1xuXG4gICAgY29uc29sZS5sb2coXCJcXG5OdXRyaWVudCBsb2FkZWQgZnJvbSBBcnJheUJ1ZmZlciFcIik7XG4gICAgY29uc29sZS5sb2coXCJcXG5Gb3IgcHJvdGVjdGVkIFBERnMsIHVzZSB0aGlzIHBhdHRlcm46XCIpO1xuICAgIGNvbnNvbGUubG9nKFwiY29uc3QgaW5zdGFuY2UgPSBhd2FpdCBsb2FkUHJvdGVjdGVkUERGKFwiKTtcbiAgICBjb25zb2xlLmxvZyhcIiAgJ2h0dHBzOi8vZXhhbXBsZS5jb20vcHJvdGVjdGVkLnBkZicsXCIpO1xuICAgIGNvbnNvbGUubG9nKFwiICAnbXlVc2VybmFtZScsXCIpO1xuICAgIGNvbnNvbGUubG9nKFwiICAnbXlQYXNzd29yZCdcIik7XG4gICAgY29uc29sZS5sb2coXCIpO1wiKTtcblxuICAgIHJldHVybiBpbnN0YW5jZTtcbiAgfSk7XG4iLCJjc3MiOiIvKiBBZGQgeW91ciBDU1MgaGVyZSAqL1xuXHQifQ%253D%253D)):

```js

async function loadProtectedPDF(url, username, password) {
  // Base-64 encode your credentials and set them as an `Authorization` header.
  const headers = new Headers();
  const encodedCredentials = btoa(`${username}:${password}`);
  headers.set("Authorization", `Basic ${encodedCredentials}`);

  try {
    // Fetch the PDF and read the response as an `ArrayBuffer`.
    const pdfResponse = await fetch(url, { headers });
    if (!pdfResponse.ok) {
      throw new Error(`HTTP error: ${pdfResponse.status}`);
    }
    const document = await pdfResponse.arrayBuffer();

    // Pass the `ArrayBuffer` as a PDF option instead of a URL.
    const instance = await NutrientViewer.load({
      container: "#pspdfkit",

      document
    });
    console.log("Protected document loaded successfully");
    return instance;
  } catch (error) {
    if (error.message.includes("401")) {
      console.error("Authentication failed: Invalid credentials");
    } else {
      console.error("Failed to load protected document:", error.message);
    }
    throw error;
  }
}

```
---

## Related pages

- [Create and open encrypted PDFs using JavaScript](/guides/web/standalone/accessing-protected-files.md)
- [Open password-protected PDFs in JavaScript](/guides/web/features/password-protected-pdfs.md)