# Logging in discourse using API - using discourse as API server only

**URL:** <https://meta.discourse.org/t/logging-in-discourse-using-api-using-discourse-as-api-server-only/68938>\
**Category:** Development\
**Created:** [Août 28, 2017, 4:00 UTC](https://meta.discourse.org/t/logging-in-discourse-using-api-using-discourse-as-api-server-only/68938 "2017-08-28T16:00:17Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![Tech\_Domain](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/tech_domain/32/155321_2.png) [@Tech\_Domain](https://meta.discourse.org/u/Tech_Domain)\
**Post date:** [Août 30, 2017, 2:07 UTC](https://meta.discourse.org/t/logging-in-discourse-using-api-using-discourse-as-api-server-only/68938/3 "2017-08-30T02:07:56Z")

</div>

The first one fetches the api key for user. Second method that you suggested is good for making automated requests on behalf of user.

But I want to build my own UI with discourse api.  
So I want to call login api just like ember client does

I debugged the login flow of ember.

First it calls `/csrf?_:18282829` to get a csrf token

Then it calls `/session ` with username and password and csrf token and other headers.

Funny thing is if I intercept the session api call and make it myself(by sending all cookies and headers) I get `Bad csrf` error.  
But the ember client can make the call successfully and get the user details.

So what is your csrf token strategy? Do you match session cookie and header, or is there something like secret in cookie and salt in header?

I tried to find in ruby code, but couldn’t do so. If you can point me to the file, then I will try to figure it out.

---

_[View the full topic](https://meta.discourse.org/t/logging-in-discourse-using-api-using-discourse-as-api-server-only/68938)._