Which security measure prevents credential capture in basic API authentication?

TLS/SSL encrypts the communication channel between the client and the API server. This encryption protects credentials (like usernames and passwords) from being intercepted and captured by attackers if they gain access to the network path. Without TLS/SSL, credentials sent over basic API authentication (often Base64 encoded, not truly encrypted) are vulnerable. Next-Generation Firewalls primarily focus on filtering traffic based on application, user, and content, but they don't inherently encrypt the data within a session. A VPN encrypts the entire tunnel, but TLS/SSL specifically secures the application-layer communication for the API itself, which is a more direct answer to preventing credential capture within that specific interaction. AAA services provide authentication, authorization, and accounting, but they don't encrypt the transport of the credentials themselves; they rely on underlying security mechanisms like TLS/SSL for secure transmission.