# How to Secure API Endpoints with RED.auth.needsPermission('flows.write') in HomeAssistant Node-RED?

**URL:** <https://discourse.nodered.org/t/how-to-secure-api-endpoints-with-red-auth-needspermission-flows-write-in-homeassistant-node-red/91138>\
**Category:** Developing Nodes\
**Tags:** home-assistant\
**Created:** [20 September 2024 10:23 UTC](https://discourse.nodered.org/t/how-to-secure-api-endpoints-with-red-auth-needspermission-flows-write-in-homeassistant-node-red/91138 "2024-09-20T10:23:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![fdecourt](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/fdecourt/32/85290_2.png) [@fdecourt](https://discourse.nodered.org/u/fdecourt)\
**Post date:** [20 September 2024 10:23 UTC](https://discourse.nodered.org/t/how-to-secure-api-endpoints-with-red-auth-needspermission-flows-write-in-homeassistant-node-red/91138/1 "2024-09-20T10:23:09Z")

</div>

Hello everyone,

I'm currently working on a Node-RED custom node that involves interacting with Google Calendar's API. In standalone Node-RED installations, I use `RED.auth.needsPermission('flows.write')` to secure the API endpoint that handles OAuth authentication callbacks. This works perfectly to ensure that only authenticated users can access sensitive flows or modify settings.

However, when Node-RED is installed through **HomeAssistant** , this security mechanism doesn't seem to work as expected. Users are repeatedly asked to enter their HomeAssistant login credentials during the OAuth process, which is not ideal for user experience.

My questions are:

1. Is there a way to properly use `RED.auth.needsPermission('flows.write')` in a HomeAssistant-managed Node-RED environment without causing repeated authentication prompts?\*\*
2. Does HomeAssistant already provide sufficient security mechanisms for these endpoints, making `RED.auth.needsPermission()` redundant in this context?\*\*
3. If so, should I be detecting the mode of Node-RED installation (standalone vs. HomeAssistant) within my node and apply security checks accordingly? If possible, how can this be done?\*\*

Any guidance or alternative approaches would be highly appreciated!

Thank you!

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [20 September 2024 11:14 UTC](https://discourse.nodered.org/t/how-to-secure-api-endpoints-with-red-auth-needspermission-flows-write-in-homeassistant-node-red/91138/2 "2024-09-20T11:14:36Z")

</div>

Hi @fdecourt

I think you will need to approach the HA community for this one.

Most here do not use HA, and we don’t know how Butchered their version of Node RED is.

@knolleary may have some insights into the authentication API - but it sounds to me this is a problem with HA.

RE: point 2/3…  
IMO I wouldn’t code for HA specifics - given this is for Node RED and not HA.

---

<div class="post-metadata">

**Author:** ![fdecourt](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/fdecourt/32/85290_2.png) [@fdecourt](https://discourse.nodered.org/u/fdecourt)\
**Post date:** [20 September 2024 12:07 UTC](https://discourse.nodered.org/t/how-to-secure-api-endpoints-with-red-auth-needspermission-flows-write-in-homeassistant-node-red/91138/3 "2024-09-20T12:07:35Z")

</div>

> [@marcus-j-davies](#):
>
> insights into the authentication API

Thanks @marcus-j-davies , I agree, I don't want to code it specifically for HomeAssistant... but I want to try to find something as universal as possible. I will keep the version as it is today, knowing that from HomeAssistant, user will have to enter its HA credential (this is not a big issue !!!) I will ask on the HA forum (and I updated the README on github to inform about the impact on HomeAssistant ;-))

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [19 November 2024 12:08 UTC](https://discourse.nodered.org/t/how-to-secure-api-endpoints-with-red-auth-needspermission-flows-write-in-homeassistant-node-red/91138/4 "2024-11-19T12:08:02Z")

</div>

Closed on 19 November 2024 12:08 UTC

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.