# API Auth without Cookies

**URL:** <https://forum.getkirby.com/t/api-auth-without-cookies/23354>\
**Category:** Questions\
**Tags:** v3\
**Created:** [September 8, 2021, 12:39pm UTC](https://forum.getkirby.com/t/api-auth-without-cookies/23354 "2021-09-08T12:39:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![degoya](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/degoya/32/10746_2.png) [@degoya](https://forum.getkirby.com/u/degoya)\
**Post date:** [September 8, 2021, 12:39pm UTC](https://forum.getkirby.com/t/api-auth-without-cookies/23354/1 "2021-09-08T12:39:04Z")

</div>

I’ve built a headless website with Kirby and Vue. Therefore, I’ve added some API Endpoints and do the Auth via Token. Everything works as expected but now I have a Cookie set in the Frontend.

I’d like to get rid of that Cookie because I don’t like to have any Cookies on the Site.

I’ve switched to Basic Auth. This works good on my local Environment, but when I move to my password protected Staging. The API calls won’t work anymore because the authenticated user isn’t logged in. When I try to access the Panel I get an error that the User doesn’t exists.

When I set up the CMS API-User in the htaccess at least the Frontend API calls work but I’m still not able to get into the Panel. When I add a user that got access to the Panel I can access the Panel but the Frontend API call fail.

Is there a way to get the Auth working without Cookie or Setting up the Users in htaccess when using Basic Auth?

Is there a way to have unauthorized calls to the API?

---

<div class="post-metadata">

**Author:** ![pixelijn](https://avatars.discourse-cdn.com/v4/letter/p/7ab992/32.png) [@pixelijn](https://forum.getkirby.com/u/pixelijn)\
**Post date:** [September 8, 2021, 1:26pm UTC](https://forum.getkirby.com/t/api-auth-without-cookies/23354/2 "2021-09-08T13:26:07Z")

</div>

Re your Basic Auth issue: [Htpasswd protection blocks panel login - #7 by Adspectus](https://forum.getkirby.com/t/htpasswd-protection-blocks-panel-login/23218/7)

The API needs authentication, either Basic Auth or session based. The alternative is custom endpoints, e.g. via Content Representations or custom (non-API) routes.

---

<div class="post-metadata">

**Author:** ![degoya](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/degoya/32/10746_2.png) [@degoya](https://forum.getkirby.com/u/degoya)\
**Post date:** [September 8, 2021, 4:01pm UTC](https://forum.getkirby.com/t/api-auth-without-cookies/23354/3 "2021-09-08T16:01:33Z")

</div>

ok ty, i removed all the routes from api to normal routes, that solved my problem.