# HTTP request node error 401 "unauthorised" if Node Red Editor credentials activated

**URL:** <https://discourse.nodered.org/t/http-request-node-error-401-unauthorised-if-node-red-editor-credentials-activated/88795>\
**Category:** General\
**Tags:** http-request\
**Created:** [19 June 2024 11:07 UTC](https://discourse.nodered.org/t/http-request-node-error-401-unauthorised-if-node-red-editor-credentials-activated/88795 "2024-06-19T11:07:44Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![SuperNinja](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/superninja/32/5761_2.png) [@SuperNinja](https://discourse.nodered.org/u/SuperNinja)\
**Post date:** [19 June 2024 11:07 UTC](https://discourse.nodered.org/t/http-request-node-error-401-unauthorised-if-node-red-editor-credentials-activated/88795/1 "2024-06-19T11:07:44Z")

</div>

NR 3.1.11 working on Raspberry pi

I wanted to secure access to the Node Red editor by uncommenting the Security\>adminAuth part in settings.js and change the with Hash security password by mine.  
And since then, when I launch my Node Red editor with my credentials, my HTTP request Get node, to display settings of NR ...

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/d/5/d5855d0981feeb6a7cdc65297e1cb13751b44633.jpeg)

it return an unauthorized message code 401:

```auto
payload: "Unauthorized"
topic: ""
myIp: "192.168.1.54"
statusCode: 401
headers: object
access-control-allow-origin: "*"
www-authenticate: "Bearer realm="Users""
date: "Wed, 19 Jun 2024 10:44:07 GMT"
connection: "close"
content-length: "12"
x-node-red-request-node: "c48843e0"
responseUrl: "http://192.168.1.54:1880/settings"
redirectList: array[0]
retry: 0

```

Maybe I made a mistake in the type of credentials? basic authentication?  
I tried Digest authentication and it returns “Bad Request”  
You can try with this flow after changing the IP address of your NR server and the credentials of the NR publisher

```auto
[
    {
        "id": "503b84433ddbc4f5",
        "type": "http request",
        "z": "1dec9bbc.37a314",
        "name": "installedVersion",
        "method": "GET",
        "ret": "obj",
        "paytoqs": "ignore",
        "url": "http://192.168.1.54:1880/settings",
        "tls": "",
        "persist": false,
        "proxy": "",
        "insecureHTTPParser": false,
        "authType": "basic",
        "senderr": false,
        "headers": [],
        "x": 810,
        "y": 1650,
        "wires": [
            [
                "5666227af19759e8",
                "bcb627c8cf5e0ef3"
            ]
        ],
        "info": "http://192.168.1.54:1880/settings"
    },
    {
        "id": "5666227af19759e8",
        "type": "debug",
        "z": "1dec9bbc.37a314",
        "name": "NRversion buff",
        "active": true,
        "tosidebar": true,
        "console": false,
        "tostatus": false,
        "complete": "true",
        "targetType": "full",
        "statusVal": "",
        "statusType": "auto",
        "x": 1010,
        "y": 1680,
        "wires": []
    },
    {
        "id": "a44a30ce418c0458",
        "type": "inject",
        "z": "1dec9bbc.37a314",
        "name": "verif new Version 12h",
        "props": [
            {
                "p": "payload"
            },
            {
                "p": "topic",
                "vt": "str"
            }
        ],
        "repeat": "43200",
        "crontab": "",
        "once": true,
        "onceDelay": "20",
        "topic": "",
        "payload": "",
        "payloadType": "date",
        "x": 750,
        "y": 1710,
        "wires": [
            [
                "503b84433ddbc4f5"
            ]
        ],
        "info": "360h = 15days\n168h = 7 days"
    },
    {
        "id": "bcb627c8cf5e0ef3",
        "type": "function",
        "z": "1dec9bbc.37a314",
        "name": "actualVersion",
        "func": "//let str = msg.payload;\n\nlet actualVersion = msg.payload.version;//str.substring(31,36);\nmsg.actualVersion = \"v\"+actualVersion;\nreturn msg",
        "outputs": 1,
        "timeout": "",
        "noerr": 0,
        "initialize": "",
        "finalize": "",
        "libs": [],
        "x": 970,
        "y": 1600,
        "wires": [
            [
                "ea2c4e06c8072d4a"
            ]
        ]
    },
    {
        "id": "ea2c4e06c8072d4a",
        "type": "debug",
        "z": "1dec9bbc.37a314",
        "name": "NRversion",
        "active": true,
        "tosidebar": true,
        "console": false,
        "tostatus": false,
        "complete": "true",
        "targetType": "full",
        "statusVal": "",
        "statusType": "auto",
        "x": 1030,
        "y": 1640,
        "wires": []
    }
]

```

Thanks to those who can help me

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [19 June 2024 11:23 UTC](https://discourse.nodered.org/t/http-request-node-error-401-unauthorised-if-node-red-editor-credentials-activated/88795/2 "2024-06-19T11:23:29Z")

</div>

Hi @SuperNinja

The editor is not using **Basic Auth**.  
it is using a token based authentication.

See below.

[https://nodered.org/docs/api/admin/oauth](https://nodered.org/docs/api/admin/oauth)

---

<div class="post-metadata">

**Author:** ![SuperNinja](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/superninja/32/5761_2.png) [@SuperNinja](https://discourse.nodered.org/u/SuperNinja)\
**Post date:** [19 June 2024 12:22 UTC](https://discourse.nodered.org/t/http-request-node-error-401-unauthorised-if-node-red-editor-credentials-activated/88795/3 "2024-06-19T12:22:46Z")

</div>

Great, it works Thanks !  
For newbies like me : just type in the RPI terminal:

```auto
curl http://localhost:1880/auth/token --data 'client_id=node-red-editor&grant_type=password&scope=*&username=admin&password=password'

```

by changing **admin** and **password** with your credentials  
which generates a Token that we copy and paste into the HTTP request Node by setting the Type to “Bearer Autentication”

Last question @marcus-j-davies `"expires_in":604800,` Does this mean that the token will have to be redone regularly? If yes, how to do it automatically?

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [19 June 2024 14:20 UTC](https://discourse.nodered.org/t/http-request-node-error-401-unauthorised-if-node-red-editor-credentials-activated/88795/4 "2024-06-19T14:20:40Z")

</div>

> [@SuperNinja](#):
>
> Does this mean that the token will have to be redone regularly? If yes, how to do it automatically?

Instead of manually CURLing for the token, do it in node-red! Use http request to get and store the token in context, and use the context stored token for further requests.

---

<div class="post-metadata">

**Author:** ![SuperNinja](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/superninja/32/5761_2.png) [@SuperNinja](https://discourse.nodered.org/u/SuperNinja)\
**Post date:** [19 June 2024 16:46 UTC](https://discourse.nodered.org/t/http-request-node-error-401-unauthorised-if-node-red-editor-credentials-activated/88795/5 "2024-06-19T16:46:32Z")

</div>

sorry for this newbie question but how to do it? I tried to put :

```auto
http://localhost:1880/auth/token --data 'client_id=node-red-admin&grant_type=password&scope=*&username=xxxx&password=xxxxx'

```

in the HTTP request node to get a Token, but it doesn't work. I imagine it's not that easy?

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [19 June 2024 16:54 UTC](https://discourse.nodered.org/t/http-request-node-error-401-unauthorised-if-node-red-editor-credentials-activated/88795/6 "2024-06-19T16:54:31Z")

</div>

Here is one I made earlier 😃

You can then store the token (In a context variable)  
and pass that to future requests.

This also setups the ability to renew the token

```auto
[{"id":"ea1abe3597de3285","type":"change","z":"d38d8fca17d3ca65","name":"","rules":[{"t":"set","p":"payload","pt":"msg","to":"{\t \"client_id\": \"node-red-editor\",\t \"grant_type\" : \"password\",\t \"scope\": \"*\",\t \"username\":username,\t \"password\":password\t}","tot":"jsonata"}],"action":"","property":"","from":"","to":"","reg":false,"x":400,"y":180,"wires":[["428b21b0f67de7d0"]]},{"id":"428b21b0f67de7d0","type":"http request","z":"d38d8fca17d3ca65","name":"","method":"POST","ret":"obj","paytoqs":"ignore","url":"http://localhost:1880/auth/token","tls":"","persist":false,"proxy":"","insecureHTTPParser":false,"authType":"","senderr":false,"headers":[],"x":610,"y":180,"wires":[["14e5474d9286bea3"]]},{"id":"b3db3e199c65ab14","type":"inject","z":"d38d8fca17d3ca65","name":"","props":[{"p":"username","v":"MyUsername","vt":"str"},{"p":"password","v":"MyPassword","vt":"str"}],"repeat":"","crontab":"","once":false,"onceDelay":0.1,"topic":"","x":210,"y":180,"wires":[["ea1abe3597de3285"]]},{"id":"14e5474d9286bea3","type":"debug","z":"d38d8fca17d3ca65","name":"debug 383","active":true,"tosidebar":true,"console":false,"tostatus":false,"complete":"false","statusVal":"","statusType":"auto","x":830,"y":180,"wires":[]}]

```

## Explanation

This **POSTs** the property of **payload** (which is an object to begin with, but is then converted to post data for the API)

**payload** receives the **username** and **password** from the **inject** to create the requests body that is posted

**payload** is seen as the main property in Node RED (so HTTP Request Node uses it as the body to **POST** )

The HTTP Request Node. converts it to post data (application/x-www-form-urlencoded)

---

<div class="post-metadata">

**Author:** ![SuperNinja](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/superninja/32/5761_2.png) [@SuperNinja](https://discourse.nodered.org/u/SuperNinja)\
**Post date:** [19 June 2024 20:42 UTC](https://discourse.nodered.org/t/http-request-node-error-401-unauthorised-if-node-red-editor-credentials-activated/88795/7 "2024-06-19T20:42:34Z")

</div>

I see : to send the Body to the HTTP request node it's a **msg.payload** object .  
Now that I have my Token, if I want to use it to access the Settings I must send an Authorization header like this:  
`"Authorization: Bearer A_SECRET_TOKEN"`

to my HTTP GET node [http://localhost:1880/settings](http://localhost:1880/settings)

Thanks to [Set a request header : Node-RED](https://cookbook.nodered.org/http/set-request-header) and [Authentication : Node-RED](https://nodered.org/docs/api/admin/oauth)  
I sent a **msg.headers** object ` {"Authorization": "Bearer A_SECRET_TOKEN"}`  
and it seems to work 🙂 can you confirm that I have it right?

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [19 June 2024 20:53 UTC](https://discourse.nodered.org/t/http-request-node-error-401-unauthorised-if-node-red-editor-credentials-activated/88795/8 "2024-06-19T20:53:00Z")

</div>

That is correct 👍

You can do the login each time, and use the returned token inline.

or create an interval (inject node)...  
To login and store the token using context, for later use.

you can then use that stored token

```auto
{
   'Authorization': `Bearer ${flow.get('Token')}`,
   'Other-Header': 'Other Value',
}

```

Doing the login each time is prob easier

storing to context

```auto
flow.set('Token',msg.payload...token...path)

```

---

<div class="post-metadata">

**Author:** ![SuperNinja](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/superninja/32/5761_2.png) [@SuperNinja](https://discourse.nodered.org/u/SuperNinja)\
**Post date:** [20 June 2024 11:59 UTC](https://discourse.nodered.org/t/http-request-node-error-401-unauthorised-if-node-red-editor-credentials-activated/88795/9 "2024-06-20T11:59:46Z")

</div>

Great ! I learned some new things about NR again, great! 👍

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [4 July 2024 12:00 UTC](https://discourse.nodered.org/t/http-request-node-error-401-unauthorised-if-node-red-editor-credentials-activated/88795/10 "2024-07-04T12:00:32Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.