Switch to OAuth 2 from HTTP Basic Auth and OAuth 1.0a. They are being deprecated.
See openstreetmap/operations#867

Note, api.openstreetmap.org API url currently can not do OAuth 2 handshake. See openstreetmap/operations#951 (comment)
You can split the www. base URL and api. API url. See osmlab/osm-auth#123 (comment)