Clearly a HttpClient (non-browser) requires an AuthenticationHeaderValue indicating the Basic scheme and the Base64 encoded username:password.

All IIS authentication for the web app should be disabled--go to IIS manager for this web app and go to authentication and disable all: anonymous, forms, basic, windows, impersonation.

I removed the <system.web><authentication> element in the web.config

It would be interesting to see an example with a Handler rather than a Module.

There should be much better guidance as to how to configure IIS to make this work.

Microsoft seem hell bent on describing Web API security as something either done via Windows Authentication or by using Forms and a browser when absolutely no one is using Web API in that context.

Given that most security vulnerabilities occur through poor execution of best practice, Microsoft needs to offer clearer guidance on how to implement Authentication in Web API.

My assembly was called "AuthModule" and so I needed to change the above attribute to type="WebHostBasicAuth.Modules.BasicAuthHttpModule, AuthModule" and the resulting DLL placed in the BIN folder of my Web API application.

This is not explained well in the guidance above.