# API: Can I authenticate without putting the key in the URL?

**URL:** <https://meta.discourse.org/t/api-can-i-authenticate-without-putting-the-key-in-the-url/29425>\
**Category:** Development\
**Tags:** rest-api\
**Created:** [29 Mayo, 2015 18:17 UTC](https://meta.discourse.org/t/api-can-i-authenticate-without-putting-the-key-in-the-url/29425 "2015-05-29T18:17:35Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![mc0e](https://avatars.discourse-cdn.com/v4/letter/m/c77e96/32.png) [@mc0e](https://meta.discourse.org/u/mc0e)\
**Post date:** [29 Mayo, 2015 18:17 UTC](https://meta.discourse.org/t/api-can-i-authenticate-without-putting-the-key-in-the-url/29425/1 "2015-05-29T18:17:35Z")

</div>

Continuing the discussion from [Discourse API Documentation](https://meta.discourse.org/t/discourse-api-documentation/22706):

> [@Discourse REST API Documentation](https://meta.discourse.org/t/discourse-rest-api-documentation/22706/1):
>
> To become authenticated you will need to create an API Key from the admin panel.
> 
> Once you have your API Key you can pass it in as a url parameter like this:
> 
> ```
> curl http://localhost:3000/c/test/sub-test.json?api_key=test_d7fd0429940&api_username=test_user
> 
> ```

An unfortunate (in this context) characteristic of GET parameters is that they get logged all over the place, possibly including the discourse server, load balancers or proxies closer to the client.

Is there a way to provide the authentication details other than as GET parameters? E.g. many APIs allow for them to be passed via a custom HTTP header.

---

_[View the full topic](https://meta.discourse.org/t/api-can-i-authenticate-without-putting-the-key-in-the-url/29425)._