# Can not access api with query param, but auth headers

**URL:** <https://discourse.getcockpit.com/t/can-not-access-api-with-query-param-but-auth-headers/1774>\
**Category:** Support\
**Created:** [January 6, 2021, 12:26pm UTC](https://discourse.getcockpit.com/t/can-not-access-api-with-query-param-but-auth-headers/1774 "2021-01-06T12:26:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ArturS](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/arturs/32/752_2.png) [@ArturS](https://discourse.getcockpit.com/u/ArturS)\
**Post date:** [January 6, 2021, 12:26pm UTC](https://discourse.getcockpit.com/t/can-not-access-api-with-query-param-but-auth-headers/1774/1 "2021-01-06T12:26:15Z")

</div>

Hello,

I cant access the API over query params. If I use the token in the request headers, everything works fine. Over the query param I am always getting “Unauthorized” error as json payload, not an HTTP error code.

Do I need to change the configuration of nginx or cockpit itself? Cockpit is also running in a subfolder, hosted on a strato server. Our server admin guys told me, they needed to change the nginx config to the subfolder. Because I had issues with the redirect.

Hopefully you can help me.  
Kind regards

---

<div class="post-metadata">

**Author:** ![pixelkarma](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/pixelkarma/32/748_2.png) [@pixelkarma](https://discourse.getcockpit.com/u/pixelkarma)\
**Post date:** [January 8, 2021, 6:46am UTC](https://discourse.getcockpit.com/t/can-not-access-api-with-query-param-but-auth-headers/1774/2 "2021-01-08T06:46:48Z")

</div>

Your API-KEY, are the rules set to \* (asterisk)?

Does the URL you are using have the token in it?

/api/whatever?token=YOURTOKEN

---

<div class="post-metadata">

**Author:** ![ArturS](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/arturs/32/752_2.png) [@ArturS](https://discourse.getcockpit.com/u/ArturS)\
**Post date:** [January 8, 2021, 11:53am UTC](https://discourse.getcockpit.com/t/can-not-access-api-with-query-param-but-auth-headers/1774/3 "2021-01-08T11:53:32Z")

</div>

I am using the master-api-key.  
Yes the token is in the url, that is what I mean with query params.  
This token is working, if it is in the request header as mentioned in the documentation [API](https://getcockpit.com/documentation/api).  
The only method, which does not work is the query parameter, the others are working.  
Unfortunately the query paramter method is the only one supported of the gatsby-cockpit-plugin, because I want to use Cockpit CMS with gatsby.

---

<div class="post-metadata">

**Author:** ![pixelkarma](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/pixelkarma/32/748_2.png) [@pixelkarma](https://discourse.getcockpit.com/u/pixelkarma)\
**Post date:** [January 8, 2021, 7:42pm UTC](https://discourse.getcockpit.com/t/can-not-access-api-with-query-param-but-auth-headers/1774/4 "2021-01-08T19:42:44Z")

</div>

The following worked for me:

```
fetch("http://domain.com/api/collections/get/Pages", {
   "method": "GET",
   "headers": {
     "Cockpit-Token": "KEY_GOES_HERE"
   }
})

```

Or, if you prefer cURL

curl --request GET   
–url [http://domain.com/api/collections/get/Pages](http://domain.com/api/collections/get/Pages)   
–header ‘Cockpit-Token: KEY\_GOES\_HERE’ \

Also, a direct URL

```
http://domain.com/api/collections/get/Pages?token=KEY_GOES_HERE

```

After some searching, I have noticed this is a problem for other people, this also works:

```
"headers": {
"Authorization": "Bearer KEY_GOES_HERE"
}

```

Are you able to provide some sample code?