Using API Token but get message: "Basic auth with password is not allowed on this instance"

andrzej.gieralt

Hello,

 

I am trying to create a way for users to create JIRAs and am very new to the JIRA Rest API. I have created a Token for myself, and am using it in the code using these lines: 

restReq.open "POST", url, false, passw
restReq.send

...where passw is equal to the token surrounded within this: "<...;"

I am getting a message saying "Basic auth with password is not allowed on this instance" but, clearly I am using the Token. Does anyone know how to solve this?

 

Thanks

Andy Heinzer

Hi Andrzej,

I see that you're using Jira Cloud, and you are using an API token to try to authenticate here.  But you are getting an error message that indicates you cannot use basic auth with a password, even though this is an API token.  Last year we deprecated support for basic auth to use passwords and cookie based-authentication for Jira Cloud. We've tried to document this in Basic auth for REST APIs as well.  The bottom of that page has a section I think is relevant in your case:

Authentication challenges

Because Jira permits a default level of access to anonymous users, it does not supply a typical authentication challenge. Some HTTP client software expect to receive an authentication challenge before they will send an authorization header. This means that it may not behave as expected. In this case, you may need to configure it to supply the authorization header, as described above, rather than relying on its default mechanism.

Try following the steps to supply this authorization info via the passed headers in that 2nd link instead.  It does require you to build a string of emailaddress:APItoken and then base64 encode it.  That resulting string is what has to be passed in the header, not the API token itself.  Right now, you are technically trying to pass the API token as if it was a password.  This particular error message is letting us know we can't do that.

I know that it was once possible in the past to use the API token in the manner you are using it now, but I believe this change was made intentionally to improve the security aspects of using basic auth here.

Let me know if you have any questions or concerns about following these steps.

Andy