All API calls return Unauthorized. about pfsense-api

[jaredhendrickson13]

My apologies for the lack of documentation, this API is still very much a work in progress and I unfortunately have less time to work on it than I had hoped. Any contributions to documentation would be very much appreciated.

By default, the API will use the same credentials as the pfSense webConfigurator. A client-id and client-token must be specified in your payload to authenticate the API call. Your client-id and client-token will differ depending on which auth mode you have set in the General > API settings page within the UI:

• Local database is the default setting. This will allow you to authenticate using the same credentials as an existing UI user. Your client-id will be your UI username, and the client-token will be your UI password. For example, https://localhost/api/v1/users/?client-id=admin&client-token=pfsense
• Base64 will also allow you to use an existing UI user, but the client-id and client-token parameters must be Base64 encoded in your payload. For example, https://localhost/api/v1/users/?client-id=YWRtaW4K&client-token=cGZzZW5zZQo
• API Token will allow you to generate unique API tokens that will remain static. You can create an API token by setting the auth mode to API Token within the General > API settings page in the UI. You will need to save the changes, then a button to generate an API token will appear. You should get a dialogue containing the client-token (which will only be displayed once) and your client-id can be found in the API tokens table at the bottom of the page. For example, https://localhost/api/v1/users/?client-id=61646d696e&client-token=4ef51f460b78cc1ff0d6667b447b3031

Let me know if this allows you to authenticate.

[voice1]

Thank you for the clarification, typically when one reads HTTP Basic auth, the process is performed using that protocol, and can be performed with curl's --username param.
Not sure how pfSense is performing it under the hood. Passing the URL parameters however does work, although this is probably not the most secure method, it does work. - Thank you.