# CockpitQL addon ( Mutation and Authentication )

**URL:** <https://discourse.getcockpit.com/t/cockpitql-addon-mutation-and-authentication/1079>\
**Category:** Addons\
**Created:** [November 6, 2019, 3:07pm UTC](https://discourse.getcockpit.com/t/cockpitql-addon-mutation-and-authentication/1079 "2019-11-06T15:07:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ronaldaug](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/ronaldaug/32/260_2.png) [@ronaldaug](https://discourse.getcockpit.com/u/ronaldaug)\
**Post date:** [November 6, 2019, 3:07pm UTC](https://discourse.getcockpit.com/t/cockpitql-addon-mutation-and-authentication/1079/1 "2019-11-06T15:07:38Z")

</div>

Firstly, thanks for the updates of CockpitQL addon.

Mutation is working well in **playground** under **cockpit dashboard**.

But It doesn’t seem to work when sending request from external frontend/client apps.

This is example from **Altair GraphQL Client**

 ![](https://canada1.discourse-cdn.com/flex030/uploads/getcockpit/original/1X/9241057c3208d983ddf267e8e86bc0ca3cecdf19.png)

It always showing “Unauthorized”.

---

<div class="post-metadata">

**Author:** ![artur](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/artur/32/4_2.png) [@artur](https://discourse.getcockpit.com/u/artur)\
**Post date:** [November 6, 2019, 11:19pm UTC](https://discourse.getcockpit.com/t/cockpitql-addon-mutation-and-authentication/1079/2 "2019-11-06T23:19:01Z")

</div>

Hi!

Right now you have to use an account token that has the rights to edit collection items.  
Not sure yet if I should also allow non-account tokens 🤔

---

<div class="post-metadata">

**Author:** ![ronaldaug](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.getcockpit.com/ronaldaug/32/260_2.png) [@ronaldaug](https://discourse.getcockpit.com/u/ronaldaug)\
**Post date:** [November 7, 2019, 12:59pm UTC](https://discourse.getcockpit.com/t/cockpitql-addon-mutation-and-authentication/1079/3 "2019-11-07T12:59:01Z")

</div>

Exactly @artur , it doesn’t work with non-account key, only works with account key. Thank you so much. Cockpit is way more powerful with Graphql \<3