# Authentication for api rest

**URL:** <https://forum.flowable.org/t/authentication-for-api-rest/999>\
**Category:** Flowable Engine\
**Created:** [September 25, 2017, 3:01pm UTC](https://forum.flowable.org/t/authentication-for-api-rest/999 "2017-09-25T15:01:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mmanzur](https://avatars.discourse-cdn.com/v4/letter/m/97f17d/32.png) [@mmanzur](https://forum.flowable.org/u/mmanzur)\
**Post date:** [September 25, 2017, 3:01pm UTC](https://forum.flowable.org/t/authentication-for-api-rest/999/1 "2017-09-25T15:01:10Z")

</div>

Hello everyone, I would need guidance for what I want to do. The scenario is as follows, I have a web application that uses the IDM to access. To do this, copy the flowable-task-ui mechanism. The problem arises when I want to use the api rest, since I need to send user: pass in the HTTP header by basic authentication. I have no way of knowing what the password is, which is fine. The idea I have is to modify the api in order to remove the HTTP authentication and then before each call to the methods check as does the task ui against the cookie. It does not seem the best or the cleanest, but I can not think of another way.  
Do you see it possible? Is there another way to make it better?  
Thanks and sorry for my English

Marcelo

---

<div class="post-metadata">

**Author:** ![joram](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/joram/32/26_2.png) [@joram](https://forum.flowable.org/u/joram)\
**Post date:** [September 27, 2017, 8:47pm UTC](https://forum.flowable.org/t/authentication-for-api-rest/999/2 "2017-09-27T20:47:35Z")

</div>

The internal REST api (used by the UI) also uses the cookie approach (used by IDM) … so yes, if you want to reuse the REST api (non-ui one), that’s indeed an option that’s the easiest. You’d have to adapt the spring security configuration of the rest app though.

---

<div class="post-metadata">

**Author:** ![mmanzur](https://avatars.discourse-cdn.com/v4/letter/m/97f17d/32.png) [@mmanzur](https://forum.flowable.org/u/mmanzur)\
**Post date:** [September 29, 2017, 12:02pm UTC](https://forum.flowable.org/t/authentication-for-api-rest/999/3 "2017-09-29T12:02:20Z")

</div>

Thanks Joram, I’ll try that and I’ll post the results

Thanks Again  
Marcelo