Use -[AFHTTPRequestSerializer setAuthorizationHeaderFieldWithUsername:password:] on -[AFHTTPSessionManager requestSerializer].

For example, in your AFHTTPSessionManager subclass:

@implementation MyHTTPSessionManager

- (instancetype)initWithBaseURL:(NSURL *)url {
    self = [super initWithBaseURL:url];
    if (self) {
        [self.requestSerializer setAuthorizationHeaderFieldWithUsername:@"username" password:@"password"];
    }
    return self;
}

@end