### Author:  [@mc0e](https://meta.discourse.org/u/mc0e)
#### Post date: [5월 29, 2015, 6:17오후 UTC](https://meta.discourse.org/t/api-can-i-authenticate-without-putting-the-key-in-the-url/29425/1 "2015-05-29T18:17:35Z")
Continuing the discussion from [Discourse API Documentation](https://meta.discourse.org/t/discourse-api-documentation/22706):
> [@Discourse REST API Documentation](https://meta.discourse.org/t/discourse-rest-api-documentation/22706/1):
>
> To become authenticated you will need to create an API Key from the admin panel.
>
> Once you have your API Key you can pass it in as a url parameter like this:
>
> ```
> curl http://localhost:3000/c/test/sub-test.json?api_key=test_d7fd0429940&api_username=test_user
>
> ```
An unfortunate (in this context) characteristic of GET parameters is that they get logged all over the place, possibly including the discourse server, load balancers or proxies closer to the client.
Is there a way to provide the authentication details other than as GET parameters? E.g. many APIs allow for them to be passed via a custom HTTP header.
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [5월 29, 2015, 7:18오후 UTC](https://meta.discourse.org/t/api-can-i-authenticate-without-putting-the-key-in-the-url/29425/2 "2015-05-29T19:18:57Z")
I don’t believe there is support to put the parameters in the header, but you can put them in the body of the request and not as part of the url.
---
### Author:  [@mc0e](https://meta.discourse.org/u/mc0e)
#### Post date: [5월 29, 2015, 8:13오후 UTC](https://meta.discourse.org/t/api-can-i-authenticate-without-putting-the-key-in-the-url/29425/3 "2015-05-29T20:13:19Z")
Using POST where I mean GET might work, but it’s icky at best. Arguably it’s a bug if POST is accepted in most contexts where GET is what’s meant, and I would be wary about assuming that wouldn’t become the case if it’s not now.
I wonder if there’s an OAuth based approach to be had?
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [5월 29, 2015, 9:25오후 UTC](https://meta.discourse.org/t/api-can-i-authenticate-without-putting-the-key-in-the-url/29425/4 "2015-05-29T21:25:29Z")
I believe you can send the api parameters inside the body even in a GET request.
>
I believe this is how the [discourse\_api](https://github.com/discourse/discourse_api/blob/master/lib/discourse_api/client.rb#L108) does it.
---
### Author:  [@mc0e](https://meta.discourse.org/u/mc0e)
#### Post date: [5월 29, 2015, 10:06오후 UTC](https://meta.discourse.org/t/api-can-i-authenticate-without-putting-the-key-in-the-url/29425/5 "2015-05-29T22:06:49Z")
As your linked post says, giving semantic meaning to the body of a GET request is a violation of the spec.
Looking over how github does it, using basic http authentication looks rather straight-forward.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [5월 29, 2015, 10:22오후 UTC](https://meta.discourse.org/t/api-can-i-authenticate-without-putting-the-key-in-the-url/29425/6 "2015-05-29T22:22:13Z")
I don’t mind adding support for HTTP headers used for auth like S3 does, etc … submit a PR
---
### Author:  [@adam\_beers](https://meta.discourse.org/u/adam_beers)
#### Post date: [1월 9, 2017, 5:50오전 UTC](https://meta.discourse.org/t/api-can-i-authenticate-without-putting-the-key-in-the-url/29425/7 "2017-01-09T05:50:45Z")
Was this submitted? Am I able to authenticate with Authorization headers via the API?
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [1월 10, 2017, 4:44오전 UTC](https://meta.discourse.org/t/api-can-i-authenticate-without-putting-the-key-in-the-url/29425/8 "2017-01-10T04:44:49Z")
I don’t think this has been done yet.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [1월 17, 2017, 3:03오후 UTC](https://meta.discourse.org/t/api-can-i-authenticate-without-putting-the-key-in-the-url/29425/9 "2017-01-17T15:03:42Z")
This is absolutely something I want to support and something the user API already supports.
---
### Author:  [@meglio](https://meta.discourse.org/u/meglio)
#### Post date: [5월 22, 2017, 2:17오전 UTC](https://meta.discourse.org/t/api-can-i-authenticate-without-putting-the-key-in-the-url/29425/10 "2017-05-22T02:17:41Z")
> [@blake](#):
>
> I don’t think this has been done yet.
Before that, should we send authentication parameters in request body for all GET requests? Or what is the best workaround?
---
### Author:  [@warlof](https://meta.discourse.org/u/warlof)
#### Post date: [2월 16, 2019, 7:34오전 UTC](https://meta.discourse.org/t/api-can-i-authenticate-without-putting-the-key-in-the-url/29425/11 "2019-02-16T07:34:32Z")
Hi there,
Is there any news related to putting the API Key inside an `Authorization` header instead using a query parameter ?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [2월 18, 2019, 3:07오전 UTC](https://meta.discourse.org/t/api-can-i-authenticate-without-putting-the-key-in-the-url/29425/12 "2019-02-18T03:07:51Z")
User API allows this but server API does not quite yet. I would like to add support for it cause often it is cleaner to pass this info in headers, less risk of bad caching.
---
### Author:  [@TyIsI](https://meta.discourse.org/u/TyIsI)
#### Post date: [5월 10, 2019, 9:48오후 UTC](https://meta.discourse.org/t/api-can-i-authenticate-without-putting-the-key-in-the-url/29425/13 "2019-05-10T21:48:48Z")
I’d love to see support for this as well, due to the mentioned reasons of loggings.
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [5월 10, 2019, 11:18오후 UTC](https://meta.discourse.org/t/api-can-i-authenticate-without-putting-the-key-in-the-url/29425/14 "2019-05-10T23:18:51Z")
The Discourse API now supports, and recommends passing the authentication details in the request’s HTTP headers. See the updated [Discourse REST API Documentation](https://meta.discourse.org/t/discourse-api-documentation/22706) topic and the Authentication section of [https://docs.discourse.org/](https://docs.discourse.org/) for details.
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [5월 10, 2019, 11:19오후 UTC](https://meta.discourse.org/t/api-can-i-authenticate-without-putting-the-key-in-the-url/29425/15 "2019-05-10T23:19:12Z")