# Work Around to posting
**URL:** https://meta.discourse.org/t/work-around-to-posting/44413
**Category:** SSO
**Created:** [May 17, 2016, 11:42pm UTC](https://meta.discourse.org/t/work-around-to-posting/44413 "2016-05-17T23:42:54Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@balthatrix](https://meta.discourse.org/u/balthatrix)
#### Post date: [May 17, 2016, 11:42pm UTC](https://meta.discourse.org/t/work-around-to-posting/44413/1 "2016-05-17T23:42:54Z")
I’m noticing a couple api calls I can’t make without a csrf token:
**Wanting to initialize a new user here** :
client.sync\_sso (new\_user\_info)
-and-
**Wanting to change an existing username here** :
client.put(“/users/#{old\_un}/preferences/username”, {new\_username: new\_un, username: old\_un})
Both of these are rejected by my discourse server noting lack of csrf token.
Is there a workaround for this or is this just an inherently wrong approach?
---
### Author:  [@DeanMarkTaylor](https://meta.discourse.org/u/DeanMarkTaylor)
#### Post date: [May 18, 2016, 12:31am UTC](https://meta.discourse.org/t/work-around-to-posting/44413/2 "2016-05-18T00:31:56Z")
Can you confirm you are using the API key and username as specified here?
> [@Discourse REST API Documentation](https://meta.discourse.org/t/discourse-api-documentation/22706):
>
> Discourse API Please view the Discourse API Documentation site for detailed info: [https://docs.discourse.org](https://docs.discourse.org)information_source Authentication API requests must use HTTP header based authentication. Pass your Api-Key and Api-Username as HTTP headers. Authentication via query parameters or request body is not supported (this was removed in April 2020). Please see the example cURL request below. The only API endpoints that continue to support credentials in query parameters are requests to…
---
### Author:  [@balthatrix](https://meta.discourse.org/u/balthatrix)
#### Post date: [May 18, 2016, 7:03pm UTC](https://meta.discourse.org/t/work-around-to-posting/44413/3 "2016-05-18T19:03:03Z")
I believe so. The discourse client class instance stores that info after I set it with client.api\_username= and client.api\_key=
Here’s a snapshot of my discourse server logs:
`
Started PUT “/users/mrB3/preferences/username?api_key=[key was here]&api_username=1D20” for 127.0.0.1 at 2016-05-18 11:59:45 -0700
I, [2016-05-18T11:59:45.268153 #36224] INFO – : Processing by UsersController#username as JSON
I, [2016-05-18T11:59:45.270251 #36224] INFO – : Parameters: {“new_username”=>“mrB8”, “username”=>“mrB3”, “api_key”=>“[key was here]”, “api_username”=>“1D20”}
`
---
### Author:  [@balthatrix](https://meta.discourse.org/u/balthatrix)
#### Post date: [May 18, 2016, 7:49pm UTC](https://meta.discourse.org/t/work-around-to-posting/44413/4 "2016-05-18T19:49:02Z")
@DeanMarkTaylor
Thanks for your help, I ended up figuring out the problem. My client was not given an admin username.