I'm building a simple API that will be used in an android app (that only about 3-4 users will ever have). The app connects to the server and sends GET/PUT requests.

I've read through my googling that if you are using SSL, sending passwords as plaintext without encrypting them with something like HMAC is OKAY.

People, do, however, recommend that you use "basic authentication" which is basically username:password encoded in base64 in the HTTP header. Is there a reason why I shouldn't just send the body fields "username" and "password" unencoded if I am using SSL? If a hacker really was to somehow get through the SSL why would it matter if it was encoded using base64? Surely if he is able to somehow get through the SSL he would be able to base64 decode?

Just wanted your opinions on if I should even bother doing base64 encode, thanks.