# API Authorization questions **URL:** \ **Category:** AWX Project\ **Tags:** awx\ **Created:** [February 27, 2020, 8:41pm UTC](https://forum.ansible.com/t/api-authorization-questions/32347 "2020-02-27T20:41:49Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Sami\_M\_Barek](https://avatars.discourse-cdn.com/v4/letter/s/f6c823/32.png) [@Sami\_M\_Barek](https://forum.ansible.com/u/Sami_M_Barek)\ **Post date:** [February 27, 2020, 8:41pm UTC](https://forum.ansible.com/t/api-authorization-questions/32347/1 "2020-02-27T20:41:49Z")
Hi, I’m struggling to understand how the authorization works in the API from the documentation. It seems I have a couple of different options where as I feel like I have tried them all (client\_id and client\_secret have been generated in the console already). `POST /api/o/token Content-Type: application/x-www-form-urlencoded grant_type=password&username=&password=&scope=write&client_id=&client_secret=` Above gives me a token `{ "access_token": "", "expires_in": 31536000000, "token_type": "Bearer", "scope": "write", "refresh_token": "" } // POST /api/o/token // HTTP/1.1 200 OK // Server: nginx // Date: Thu, 27 Feb 2020 19:40:12 GMT // Content-Type: application/json // Content-Length: 170 // Connection: keep-alive // Cache-Control: no-store // Pragma: no-cache // Vary: Accept-Language, Origin, Cookie // Content-Language: en // X-API-Total-Time: 0.280s // Strict-Transport-Security: max-age=15768000 // Content-Security-Policy: default-src 'self'; connect-src 'self' ws: wss:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' *.pendo.io; img-src 'self' *.pendo.io data:; report-uri /csp-violation/ // X-Content-Security-Policy: default-src 'self'; connect-src 'self' ws: wss:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' *.pendo.io; img-src 'self' *.pendo.io data:; report-uri /csp-violation/ // X-Frame-Options: DENY // Request duration: 0.357710s` Trying to now access /api/v2/job\_templates for example `GET /api/v2/job_templates Content-type: application/json Authorization: Bearer ` This still returns the following `{ "detail": "Authentication credentials were not provided. To establish a login session, visit /api/login/." } // GET /api/v2/job_templates // HTTP/1.1 401 Unauthorized // Server: nginx // Date: Thu, 27 Feb 2020 20:11:24 GMT // Content-Type: application/json // Content-Length: 107 // Connection: keep-alive // WWW-Authenticate: Bearer realm=api authorization_url=/api/o/authorize/ // Vary: Accept, Accept-Language, Origin, Cookie // Allow: GET, POST, HEAD, OPTIONS // X-API-Node: awx // X-API-Time: 0.011s // Content-Language: en // X-API-Total-Time: 0.076s // Request duration: 0.146089s` Same goes for `GET /api/v2/job_templates Content-type: application/json Authorization: Basic ` I’ve tried to POST and GET to /api/login but obviously that doesn’t help as it’s a page and not an API endpoint. I don’t know if it’s me but the documentation seems a bit fuzzy and unclear on how to actually login As a side-note, I have also tried using the to-be deprecated tower-cli `$ tower-cli login --password --client-id --client-secret ` which also returned a token ` { “expires\_in”: 31536000000, “token\_type”: “Bearer”, “scope”: “write”, “refresh\_token”: “”, “token”: “” } Configuration updated successfully. ` ---
**Author:** ![john.westcott.iv](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/john.westcott.iv/32/95_2.png) [@john.westcott.iv](https://forum.ansible.com/u/john.westcott.iv)\ **Post date:** [February 27, 2020, 9:36pm UTC](https://forum.ansible.com/t/api-authorization-questions/32347/2 "2020-02-27T21:36:10Z")
Try POSTing a payload like: { “description”: “", “application”: **None** , “scope”: “write”, } To /api/v2/tokens using basic auth to get to the page itself (don’t forget your Content-Type: application/json). That should create you a new token which you can then use in an Authorization: Bearer header like you were before. If you are going to do this programmatically, be sure to remove this token after you are done with it or they will pile up. You can see an actual example of this in the awx\_collection here: [https://github.com/ansible/awx/blob/devel/awx\_collection/plugins/module\_utils/tower\_api.py#L373](https://github.com/ansible/awx/blob/devel/awx_collection/plugins/module_utils/tower_api.py#L373) A preferred option would be to generate a single token for your application within Tower and then just use that in a Bearer header (without pulling a new token every time), -John ---
**Author:** ![Sami\_M\_Barek](https://avatars.discourse-cdn.com/v4/letter/s/f6c823/32.png) [@Sami\_M\_Barek](https://forum.ansible.com/u/Sami_M_Barek)\ **Post date:** [February 27, 2020, 9:59pm UTC](https://forum.ansible.com/t/api-authorization-questions/32347/3 "2020-02-27T21:59:42Z")
Hi John, Thanks for the reply. Yeah, the creation of tokens does not seem to be the problem here. It’s the usage of one as a bearer. I can create tokens just fine in any of the stated ways in the original post. Using the generated tokens gives me the /api/login feedback. Sorry if that want’s fully clear.