Ask HN: Vulnerabilities with Basic Auth in Header Over SSL?

Hey HN! I'm designing a(nother) API and I have a question for the more security-savvy users here. If I put my API on HTTPS and refuse insecure clients, is there any risk in doing authentication as a username:password authentication header instead of using tokens? I've used sessions and tokens in the past and the complexity of implementation makes me question if it's needed. What do you guys think? Is this safe? It feels unsafe in my gut, but in principle I can't think of anything wrong with it as long as everything happens over SSL. Please correct me if i'm mistaken.