---
title: Authenticating REST requests
related:
  - https://docs.kentico.com/k8/integrating-3rd-party-systems/kentico-rest-service/getting-data-using-rest.md
  - https://docs.kentico.com/k8/integrating-3rd-party-systems/kentico-rest-service/manipulating-data-using-rest.md
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

Every REST request needs to be authenticated. You can select the **Authentication type** of the REST service in **Settings -> Integration -> REST**.

## Basic authentication

With Basic authentication, you need to specify the username and password through the **Authorization** line in the header of every REST request. The header line consists of:

- The authentication type (_Basic_)
- The username and password connected by a colon (_**username:password**_), encoded using the Base64 algorithm

For example, the following header line uses _RestClient:MyPassword_ as the authentication credentials:

```none

Authorization: Basic UmVzdENsaWVudDpNeVBhc3N3b3Jk

```

Once authenticated, the system allows the REST request to perform operations depending on the specified user's [privilege level](https://docs.kentico.com/k8/managing-users/user-management.md) and [permissions](https://docs.kentico.com/k8/managing-users/configuring-permissions.md).

> **Note:** **Important**: We strongly recommend using [SSL](http://en.wikipedia.org/wiki/Transport_Layer_Security) to protect the authentication credentials in the request headers. See also: [Configuring SSL](https://docs.kentico.com/k8/securing-websites/deploying-websites-to-a-secure-environment/configuring-ssl.md)

> **Info:** **Note**: The _Basic authentication_ type of the Kentico REST service does not require Basic Authentication to be enabled in IIS. Keep Basic Authentication disabled in IIS as described in [Configuring the REST service](https://docs.kentico.com/k8/integrating-3rd-party-systems/kentico-rest-service/configuring-the-rest-service.md).

## Forms authentication

When using [forms authentication](http://msdn.microsoft.com/en-us/library/7t6b43z4%28v=vs.100%29.aspx) of requests, the system identifies users based on the active session and the authentication ticket stored in the .ASPXFORMSAUTH cookie. You can use forms authentication to create a web interface with a login page, and allow users to send REST requests through their browser.

You cannot use forms authentication for the Kentico REST service if you have _Windows authentication_ enabled in IIS.

Forms authentication can pose a security threat, because logged in users may unknowingly click links that send malicious REST requests to your site. To protect yourself from such attacks, take the following steps:

1. Immediately after creating the session (i.e. first authentication), set up an **authentication token** by sending a POST request to the following URL:

   ```none

   https://<your project URL>/rest/settoken?username=<your user name>&password=<your password>&token=<your authentication token>

   ```

   The authentication token can be an arbitrary string of characters, for example a GUID.
2. Include the authentication token in the HTTP header of every REST request:

   ```none

   Cms-Session-Token: <your authentication token>

   ```

## Hash parameter authentication

You can authenticate individual REST requests by adding a hash parameter to the URL. The hash parameter allows you to prepare REST requests that can be executed by unauthenticated users. Requests that contain the hash parameter ignore the other types of authentication — the value of the **Authentication type** setting does not affect hash authentication.

> **Note:** **Restrictions**
>
> - Only works for GET requests (read only data retrieval)
> - You cannot use hash parameter authentication for _/all_ [object retrieval requests](https://docs.kentico.com/k8/integrating-3rd-party-systems/kentico-rest-service/getting-data-using-rest.md) (_\~/rest//all_). This is an intentional security limitation that protects global data in the system.

> **Warning:** **Warning**: Only use hash parameter authentication for loading data that you want to make publicly available. REST requests with hash authentication can be executed by anyone who obtains the URL (for example by intercepting the web request).

To get the authentication hash for REST requests:

1. Prepare the URL of your REST request in advance.
2. Open the **Settings** application.
3. Select the **Integration -> REST** category.
4. Click **Generate authentication hash**.
5. Enter the full absolute URL of the REST request, including the protocol, website domain name, virtual directory, [REST path](https://docs.kentico.com/k8/integrating-3rd-party-systems/kentico-rest-service/getting-data-using-rest.md), and query string parameters. For example: _http://mywebsite.com/rest/content/currentsite/en-us/all/news?format=json_
6. Click **Authenticate**.

The system adds the authentication hash parameter to the URL. You can copy the URL and use it to perform the REST request without any other type of authentication.