Where to put key-value-map and basic Auth Header policies

[#1]

Hello,

I'm trying to use apigee to encode username/password request params via basic auth, and have the encoded params sent to my application backend for the appropriate request.

I'm confused about where I should put the relevant policies. From the basicAuth documentation, it seems like I need to have 2 key-value-map policies (one to get the username, and one to get the password) then feed those both the the basicAuthentication policy, which will encode them and write the encoded value to the authorization header which gets passed along to my application for decoding.

I currently have these policies linked to the pre-flow of my apiProxy endpoint. They are applied on the request that my users send. When I pass the parameters through, i get a response back that says "Invalid username/password".

Basically I just want to make sure that this is the correct place to put these policies, and that it is correct to attach them to the request.

Also, is it correct to pass username/password arguments to my request in the following way:

http://{org-name}-test.apigee.net/v1/{resource}/?username=fred&password=pass123