# "BAD CSRF" when executing PUT using API, curl, and PHP

**URL:** https://meta.discourse.org/t/bad-csrf-when-executing-put-using-api-curl-and-php/153422
**Category:** Development
**Tags:** rest-api
**Created:** [May 31, 2020, 10:31pm UTC](https://meta.discourse.org/t/bad-csrf-when-executing-put-using-api-curl-and-php/153422 "2020-05-31T22:31:46Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![simon](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/simon/32/339122_2.png) [@simon](https://meta.discourse.org/u/simon)
#### Post date: [May 31, 2020, 11:49pm UTC](https://meta.discourse.org/t/bad-csrf-when-executing-put-using-api-curl-and-php/153422/2 "2020-05-31T23:49:28Z")

</div>

You need to put the `Api-Key` and `Api-Username` values in the request header. There’s a curl example near the end of this topic that could be helpful: [Sync DiscourseConnect user data with the sync\_sso route](https://meta.discourse.org/t/sync-sso-user-data-with-the-sync-sso-route/84398).

---

_[View the full topic](https://meta.discourse.org/t/bad-csrf-when-executing-put-using-api-curl-and-php/153422)._