diff -Nur observium-trunk/html/includes/authenticate.inc.php observium/html/includes/authenticate.inc.php
--- observium-trunk/html/includes/authenticate.inc.php	2019-10-08 08:31:18.970361071 +1000
+++ observium/html/includes/authenticate.inc.php	2019-10-08 09:11:47.479226742 +1000
@@ -108,6 +108,12 @@
   $config['auth_mechanism'] = "mysql";
 }
 
+if (substr($_SERVER['REQUEST_URI'], 0, 5) === "/api/" && isset($config['api']['auth_mechanism']))
+{
+  // API request and config exists to utilise API specific auth mechanism
+  $config['auth_mechanism'] = $config['api']['auth_mechanism'];
+}
+
 // Trust Apache authenticated user, if configured to do so and username is available
 if ($config['auth']['remote_user'] && $_SERVER['REMOTE_USER'] != '')
 {
diff -Nur observium-trunk/html/includes/authentication/api_token.inc.php observium/html/includes/authentication/api_token.inc.php
--- observium-trunk/html/includes/authentication/api_token.inc.php	1970-01-01 10:00:00.000000000 +1000
+++ observium/html/includes/authentication/api_token.inc.php	2019-10-08 09:02:41.097256964 +1000
@@ -0,0 +1,85 @@
+<?php
+
+/**
+ * Observium
+ *
+ *   This file is part of Observium.
+ *
+ * @package    observium
+ * @subpackage authentication
+ * @copyright  (C) 2006-2013 Adam Armstrong, (C) 2013-2019 Observium Limited
+ *
+ */
+
+if (!$_SESSION['authenticated'] && !is_cli())
+{
+  if (isset($_SERVER[$config['api']['api_token_header']]))
+  {
+    $token = $_SERVER[$config['api']['api_token_header']];
+  }
+
+  if ($_SESSION['relogin'] || empty($token) || !api_authenticate($token))
+  {
+    print_error('Failed to auth API request with: ' . $token);
+    print_error('relogin: ' . $_SESSION['relogin']);
+    api_require_auth();
+  } else {
+    session_set_var('username', api_authenticated_user($token));
+    session_set_var('token', $token);
+    session_set_var('authenticated', true);
+  }
+}
+
+/**
+ * This function forces a login prompt via basic HTTP authentication by making the browser believe
+ * the authentication has failed. Required to log out a basic HTTP auth session.
+ */
+function api_require_auth()
+{
+  header('HTTP/1.1 401 Unauthorized');
+
+  print_error_permission();
+
+  session_logout();
+  die();
+}
+
+/**
+ * Check username and password against MySQL authentication backend.
+ * Cut short if remote_user setting is on, as we assume the user has already authed against Apache.
+ *
+ * @param string $username User name to check
+ * @param string $password User password to check
+ * @return int Authentication success (0 = fail, 1 = success) FIXME bool
+ */
+function api_authenticate($token)
+{
+  $row = dbFetchRow("SELECT `users`.`username` FROM `api_tokens` INNER JOIN `users` ON `users`.`user_id` = `api_tokens`.`user_id` WHERE `token` = ?", array($token));
+
+  if ($row['username'])
+  {
+    return 1;
+  }
+
+  return 0;
+}
+
+/**
+ * Return username that token permits authentication as
+ *
+ * @param string $token API token to check
+ * @return string username
+ */
+function api_authenticated_user($token)
+{
+  $row = dbFetchRow("SELECT `users`.`username` FROM `api_tokens` INNER JOIN `users` ON `users`.`user_id` = `api_tokens`.`user_id` WHERE `token` = ?", array($token));
+
+  if ($row['username'])
+  { 
+    return $row['username'];
+  }
+
+  return '';
+}
+
+// EOF
diff -Nur observium-trunk/includes/defaults.inc.php observium/includes/defaults.inc.php
--- observium-trunk/includes/defaults.inc.php	2019-10-01 09:15:10.270668896 +1000
+++ observium/includes/defaults.inc.php	2019-10-08 09:13:34.319220833 +1000
@@ -975,7 +975,9 @@
 
 // Observium WIP API Settings
 
-$config['api']['enable']                        = FALSE;        // Enable or disable the API
+$config['api']['enable']                        = FALSE;                      // Enable or disable the API
+// $config['api']['auth_mechanism']                = 'mysql';                    // Select auth mechanism for API requests - default is actually to use $config['auth_mechanism'] unless the user defines this in config.php
+$config['api']['api_token_header']              = 'HTTP_OBSERVIUM_API_TOKEN'; // If using 'api_token' auth configurable header name for token
 
 //$config['api']['encryption']['key']              = "I_Need_To_Change_This_Key";        // Set a random encryption/decryption key
 
