# API: credentials on preflight?

**URL:** <https://forum.getkirby.com/t/api-credentials-on-preflight/12529>\
**Category:** Questions\
**Tags:** v3\
**Created:** [January 28, 2019, 10:48pm UTC](https://forum.getkirby.com/t/api-credentials-on-preflight/12529 "2019-01-28T22:48:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![grischaerbe](https://avatars.discourse-cdn.com/v4/letter/g/bbe5ce/32.png) [@grischaerbe](https://forum.getkirby.com/u/grischaerbe)\
**Post date:** [January 28, 2019, 10:48pm UTC](https://forum.getkirby.com/t/api-credentials-on-preflight/12529/1 "2019-01-28T22:48:49Z")

</div>

Hi!

Using Kirby 3 for an upcoming project was a no-brainer. Thanks for the superb quality!  
However, I have encountered an issue with using the newly available API “in CORS mode”.

Let’s assume my frontend is a Nuxt.js frontend, running on `example.org`.  
My api is on `api.example.org` and therefore considered CORS.

Using axios for an API request and Basic auth results in an `OPTIONS` request, a so called preflight. [According to the W3 specification](https://fetch.spec.whatwg.org/#cors-protocol-and-credentials) the preflight should never include credentials.  
Unfortunately this already results in a `403 Forbidden` error since axios is by design (and according to standards) omitting credentials while Kirby is looking for a user.

For now I have fixed this by including this in the [authentication.php of the holy kirby folder](https://github.com/getkirby/starterkit/blob/master/kirby/config/api/authentication.php):

```auto
$request = $this->kirby()->request();
if ($request->method() === 'OPTIONS') {
    return true;
}

```

Its not nice in any way, could someone maybe lead me to a better solution? Or clarify, if this behaviour is made by design?

Best,  
Grischa

---

<div class="post-metadata">

**Author:** ![distantnative](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.getkirby.com/distantnative/32/11319_2.png) [@distantnative](https://forum.getkirby.com/u/distantnative)\
**Post date:** [March 8, 2019, 7:47pm UTC](https://forum.getkirby.com/t/api-credentials-on-preflight/12529/2 "2019-03-08T19:47:35Z")

</div>

I am still trying to wrap my head around it. What is this preflight `OPTIONS` request for?

---

<div class="post-metadata">

**Author:** ![soovbue1](https://avatars.discourse-cdn.com/v4/letter/s/f08c70/32.png) [@soovbue1](https://forum.getkirby.com/u/soovbue1)\
**Post date:** [May 8, 2020, 12:57pm UTC](https://forum.getkirby.com/t/api-credentials-on-preflight/12529/3 "2020-05-08T12:57:54Z")

</div>

I’m still encountering this issue. I’m getting a 403 error when hitting the Kirby API with the following code:

```
axios.get('https://cms.asoov.local/api/pages/home', {
  auth: {
    username: USERNAME,
    password: PASSWORD
  }
}).then(response => console.log(response)).catch(error => console.log(error));

```

Is there a workaround around this issue?