I'm assuming you're already sending json via POST (or xml, or some other wrapper). If that's the case just move the credentials inside as new fields.

I'd structure it by moving it inside the json fields if HTTP basic auth isn't an option.

For example:

POST https://my.server/login { "username": "user", "secret": "someSecureHashAndNotThePlaintextPasswordSeriouslyDontDoThat" }