# Hashing credentials for POST /auth/token

**URL:** <https://discourse.nodered.org/t/hashing-credentials-for-post-auth-token/46583>\
**Category:** General\
**Created:** [2 June 2021 08:55 UTC](https://discourse.nodered.org/t/hashing-credentials-for-post-auth-token/46583 "2021-06-02T08:55:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![browseitall](https://avatars.discourse-cdn.com/v4/letter/b/34f0e0/32.png) [@browseitall](https://discourse.nodered.org/u/browseitall)\
**Post date:** [2 June 2021 08:55 UTC](https://discourse.nodered.org/t/hashing-credentials-for-post-auth-token/46583/1 "2021-06-02T08:55:54Z")

</div>

Not sure if this belongs into the Dashboard or General category, excuse me.

My purposes require me to make a request to `/flows` (just reloading, so I'm not passing any node information); incidentally I'll need bearer token from `/auth/token` , which expects my credentials in the request body.

I would pass them as a payload to the `http-request` node via a `function-node`, but it seems unwise to write my password into it, as plaintext - saved to the `flows.json` . I can neither use the hashed password from the `settings.js` , nor make use of the "Use authentication" option from `http-request` nodes (because -\> expects body).

What are my options here?

Using Node-Red v1.0.2 btw

---

<div class="post-metadata">

**Author:** ![browseitall](https://avatars.discourse-cdn.com/v4/letter/b/34f0e0/32.png) [@browseitall](https://discourse.nodered.org/u/browseitall)\
**Post date:** [5 June 2021 12:42 UTC](https://discourse.nodered.org/t/hashing-credentials-for-post-auth-token/46583/2 "2021-06-05T12:42:47Z")

</div>

Only option i can come up with is "throwing one under the boss", having a dummy user with just the `flows.write` permissions, which can then request the token with the required permissions, but cannot access the Editor.

That dummy account would have a revealed password. And while he cant read the flows, he could still alter the system, if he knows what hes doing. In conclusion, a pretty bad idea imo, but the only option i can see right now.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [5 June 2021 13:10 UTC](https://discourse.nodered.org/t/hashing-credentials-for-post-auth-token/46583/3 "2021-06-05T13:10:25Z")

</div>

To could use [node-red-contrib-credentials (node) - Node-RED](https://flows.nodered.org/node/node-red-contrib-credentials) to securely store the password for your flow to use without exposing it.

Having a dedicated user is probably a good idea, although with flows.write permission then can change your flows to do anything.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [19 June 2021 13:10 UTC](https://discourse.nodered.org/t/hashing-credentials-for-post-auth-token/46583/4 "2021-06-19T13:10:33Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.