Tigase HTTP REST API set up API key issue

Pratap Patil
Added over 4 years ago


When I access

I get this error

Problem accessing /rest/users. Reason:

    To access URI = '/rest/users' a valid api key is required

As instructed in tigase http api wiki I have done the following configuration in the etc/

--comp-name-5 = rest
--comp-class-5 =

I am using snapshot of tigase-server 5.2.3 from the stable branch.

  1. How should the API key be provided to the rest server, is it in the request header or in the GET parameter or somewhere else?

  2. Considering that I used the --api-keys=open_access in etc/ shouldn't the API not request any key?

    1. If there is a default password what would that be?

Your help is much appreciated.



403 error.png (23.2 KB) 403 error.png 403 error in browser (62.7 KB) file

Replies (9)

Added by Wojciech Kapcia TigaseTeam over 4 years ago

  1. you can use either - api-key parameter or Api-Key header

  2. with --api-keys=open_access there shouldn't be any notification about requirement of valid key.

what do you mean by 'default password'? it uses admin account and it's password.

Added by Pratap Patil over 4 years ago

The problem is that I never set an API key and I explicitly added "--api-keys=open_access" in the this should not be asking for the API key correct? But it still is asking so I don't know what key to provide.

Secondly, I did a command line install and it never asked for a admin password. I know that in old tigase one could set the admin accounts in tigase.xml but in the one that I installed 5.2.3 there is no tigase.xml so where should the admin accounts configuration like passwords be done?

Added by Pratap Patil over 4 years ago

I also tried the other way around.

I added a key in the etc/


I still get the same error. Please refer screenshot attached.

Does the key need to be added somewhere else too? All I did was create a random key, put it in the and restarted the Tigase server.

REST-client.png (103 KB) REST-client.png Response from REST client by adding a request header "Api-Key"

Added by Wojciech Kapcia TigaseTeam over 4 years ago

Actually I've tried latest development (master branch) and it works without a problem - can you try it?

Added by Pratap Patil over 4 years ago

I was able to make it work. It was a silly mistake that I was making.



However, after managing to get past this I am unable to login to APIs that require admin role.

The reason is this. I have used the command line manual installation which does not setup the admin account. Instead it requires that user register their first jabber account as the admin. I did the same using PSI xmpp client. But the admin password does not work on the rest api. It works in the xmpp client just fine.

Any clues why it might be happening? Do you know where to set the admin password?

Added by Andrzej Wójcik IoT 1 CloudTigaseTeam over 4 years ago

What do you pass as username to authorization dialog?

You should pass admin user's jid not only username as username so in case of user with jid whole should be passed as username to authorization dialog and proper password should be passed as password for this dialog as well.

Added by Pratap Patil over 4 years ago

Sorry for the delayed response.

You are correct. When I use the full username along with the domain name it works.

Thank you very much.

Added by István Tóth over 3 years ago


I have a problem around this with Tigase 7.0.2

First, my registrated admin name, password and the SHA1 data is not the same, as I try to authenticate in http.

In the Tigase DB: dca349b5cd2bc3e29cb2c09674bbcc9270XXXXXX [valid password]

When I send auth datas with cURL, the sended data: (curl_setopt($res, CURLOPT_USERPWD, "[valid password]"); )

the result:

GET /rest/adhoc/ HTTP/1.1

Authorization: Basic YWRtaW5AY2hhdC5tZWR2ZWtsdWIuY29tOjExOTXXXXXX


My password is right, I can login to the web interface with my account, or with any client.

I don't know, that is a problem or not, but every API call I try to call, result as forbidden

< HTTP/1.1 403 Forbidden

< Content-length: 77

< Date: Mon, 24 Aug 2015 17:48:54 GMT


  • Connection #41 to host left intact

Do I need any other setup than the usual? Shoud I give an api-key?

The second problem is if I call

  • without slash - there is no any error, only waiting - you can try out :).

Added by István Tóth over 3 years ago

Never mind

I set the api-key, that is fixed the issue.