# Arc HTTPGet Operation - How to pass Authentication: Bearer header

**URL:** <https://community.cdata.com/t/arc-httpget-operation-how-to-pass-authentication-bearer-header/193>\
**Category:** CData Arc\
**Tags:** question\
**Created:** [May 19, 2023, 4:13pm UTC](https://community.cdata.com/t/arc-httpget-operation-how-to-pass-authentication-bearer-header/193 "2023-05-19T16:13:28Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![russell-jerseypost](https://avatars.discourse-cdn.com/v4/letter/r/439d5e/32.png) [@russell-jerseypost](https://community.cdata.com/u/russell-jerseypost)\
**Post date:** [May 19, 2023, 4:13pm UTC](https://community.cdata.com/t/arc-httpget-operation-how-to-pass-authentication-bearer-header/193/1 "2023-05-19T16:13:29Z")

</div>

I’m just trying to authenticate with an API&nbsp;Endpoint which expects a fixed token to be passed as the Authorization HTTP header.

Does this look like it should work? I need to pull the token/API key from the Vault.

```xml
<arc:set attr="http.URL" value="https://api.XXXX.com/carrier/api/shipment-listing/[data.shipmentNumber]" />  <arc:set attr="http.header:Authorization" value="Bearer [Vault(My.API.Token)]"/> <arc:set attr="http.contenttype" value="application/json"/>   <arc:call op="httpGet" in="http">  <arc:set attr="output.data" value="[http:content]" /></arc:call>

```

I’m getting a 401

thanks

---

<div class="post-metadata">

**Author:** ![Ankit\_Singh](https://sea3.discourse-cdn.com/cdata/user_avatar/community.cdata.com/ankit_singh/32/1614_2.png) [@Ankit\_Singh](https://community.cdata.com/u/Ankit_Singh)\
**Post date:** [May 22, 2023, 10:26am UTC](https://community.cdata.com/t/arc-httpget-operation-how-to-pass-authentication-bearer-header/193/2 "2023-05-22T10:26:05Z")

</div>

Hi @russell-jerseypost

Just out of curiosity, are you trying to pull the Bearer Token from Arc Vault?

---

<div class="post-metadata">

**Author:** ![russell-jerseypost](https://avatars.discourse-cdn.com/v4/letter/r/439d5e/32.png) [@russell-jerseypost](https://community.cdata.com/u/russell-jerseypost)\
**Post date:** [May 22, 2023, 12:52pm UTC](https://community.cdata.com/t/arc-httpget-operation-how-to-pass-authentication-bearer-header/193/3 "2023-05-22T12:52:07Z")

</div>

Yes, It’s a fixed token with a long expiry (2 years for example)

---

<div class="post-metadata">

**Author:** ![Ankit\_Singh](https://sea3.discourse-cdn.com/cdata/user_avatar/community.cdata.com/ankit_singh/32/1614_2.png) [@Ankit\_Singh](https://community.cdata.com/u/Ankit_Singh)\
**Post date:** [May 22, 2023, 1:55pm UTC](https://community.cdata.com/t/arc-httpget-operation-how-to-pass-authentication-bearer-header/193/4 "2023-05-22T13:55:52Z")

</div>

Hey @russell-jerseypost

I just tested this out and looks like the script is correct and it should work as it is. Since you are getting 401 Unauthorized on the URL, there can be two possible reasons:

1. The API Token is expired or not valid. Causing the Authentication to fail and server to return a 401. Can you test the API token in the Arc Vault directly with REST connector with bearer token authentication to check if it works?
2. The API Token is correct but sent incorrectly to the server due to a malformed syntax or malformed request.

In general, enabling the logs should give you more information on the exact issue.&nbsp;You can also use the **\_log.info** item to log either the vault value or the value of **http.header:authorization** to the application log. This is helpful when debugging a script, to see what the value of certain attrs are at various steps in the script.

---

<div class="post-metadata">

**Author:** ![Ankit\_Singh](https://sea3.discourse-cdn.com/cdata/user_avatar/community.cdata.com/ankit_singh/32/1614_2.png) [@Ankit\_Singh](https://community.cdata.com/u/Ankit_Singh)\
**Post date:** [May 22, 2023, 1:58pm UTC](https://community.cdata.com/t/arc-httpget-operation-how-to-pass-authentication-bearer-header/193/5 "2023-05-22T13:58:54Z")

</div>

Just to add, if you can’t figure out, you can always reach out to Arc support for assistance at&nbsp;[arcsupport@cdata.com](mailto:arcsupport@cdata.com).

---

<div class="post-metadata">

**Author:** ![russell-jerseypost](https://avatars.discourse-cdn.com/v4/letter/r/439d5e/32.png) [@russell-jerseypost](https://community.cdata.com/u/russell-jerseypost)\
**Post date:** [May 23, 2023, 8:02am UTC](https://community.cdata.com/t/arc-httpget-operation-how-to-pass-authentication-bearer-header/193/6 "2023-05-23T08:02:15Z")

</div>

Thanks.

---

<div class="post-metadata">

**Author:** ![russell-jerseypost](https://avatars.discourse-cdn.com/v4/letter/r/439d5e/32.png) [@russell-jerseypost](https://community.cdata.com/u/russell-jerseypost)\
**Post date:** [May 23, 2023, 11:07am UTC](https://community.cdata.com/t/arc-httpget-operation-how-to-pass-authentication-bearer-header/193/7 "2023-05-23T11:07:29Z")

</div>

Sorry, I’m struggling to get

`<arc:set attr="_log.info" value="LOGGING! APIKey = [Vault(carrier.XXXX.com)]"/>  `

to work

I have also tried

```xml
<arc:set attr="_log.info" />LOGGING! APIKey = [Vault(carrier.XXXX.com)]</arc:set>  

```

I assume I should be looking in the message log. Not&nbsp;[logs.rst#application](http://jp-t-edi-01:8001/logs.rst#application)

---

<div class="post-metadata">

**Author:** ![russell-jerseypost](https://avatars.discourse-cdn.com/v4/letter/r/439d5e/32.png) [@russell-jerseypost](https://community.cdata.com/u/russell-jerseypost)\
**Post date:** [May 23, 2023, 11:41am UTC](https://community.cdata.com/t/arc-httpget-operation-how-to-pass-authentication-bearer-header/193/8 "2023-05-23T11:41:39Z")

</div>

Don’t worry I have found the logs in&nbsp;[logs.rst#application](http://jp-t-edi-01:8001/logs.rst#application)

---

<div class="post-metadata">

**Author:** ![russell-jerseypost](https://avatars.discourse-cdn.com/v4/letter/r/439d5e/32.png) [@russell-jerseypost](https://community.cdata.com/u/russell-jerseypost)\
**Post date:** [May 23, 2023, 12:09pm UTC](https://community.cdata.com/t/arc-httpget-operation-how-to-pass-authentication-bearer-header/193/9 "2023-05-23T12:09:38Z")

</div>

OKay, I can’t see any evidence that it is passing the Authroization header

```auto
2023-05-23T13:02:26.147+01:00	4	SSLServerCert File: Cannot find specified certificate.2023-05-23T13:02:26.147+01:00	4	SSLServerCert Encoded: Cannot find specified certificate.2023-05-23T13:02:26.241+01:00	2	[Request: 186] GET https://api.XXXX.com/carrier/api/shipment-listing/e0faca8c-XXXX-4a9c-ae6d-be886cf1bacb2023-05-23T13:02:26.241+01:00	5	[Request: 186][HTTP Headers]HTTP Auth Scheme: 0User: Password: GET /carrier/api/shipment-listing/e0faca8c-879d-XXXX-ae6d-be886cf1bacb HTTP/1.1Host: api.XXXX.comAccept-Encoding: gzip, deflateUser-Agent: CData Data Provider Engine - www.cdata.com - Accepts: gzip2023-05-23T13:02:26.897+01:00	5	[Response: 186][HTTP Headers]HTTP/1.1 401 UnauthorizedDate: Tue, 23 May 2023 12:02:26 GMTContent-Type: application/json

```

Although

```xml
<arc:set attr="_log.info">Auth = [http.header:authorization]URL = [http.URL] </arc:set>  

```

is logging the expected Bearer token okay

---

<div class="post-metadata">

**Author:** ![russell-jerseypost](https://avatars.discourse-cdn.com/v4/letter/r/439d5e/32.png) [@russell-jerseypost](https://community.cdata.com/u/russell-jerseypost)\
**Post date:** [May 23, 2023, 1:10pm UTC](https://community.cdata.com/t/arc-httpget-operation-how-to-pass-authentication-bearer-header/193/10 "2023-05-23T13:10:53Z")

</div>

I’m testing this with

`<arc:set attr="http.header:X-Custom" value="test"/> `

and

`<arc:set attr="_log.info">Auth = [http.header:*]</arc:set> `

is reporting the headers that I set as expected.in **Logs \> Application**

However when I use

\<arc:set attr=“http.verbosity” value=“5”/\>&nbsp;  
\<arc:set attr=“http.logfile” value=“D:\cData\logs\mylog.log”/\>

I don’t see these headers going out

`2023-05-23T13:59:13.160+01:00    2    [Request: 187] GET https://api.XXXX.com/carrier/api/shipment-listing/e0faca8c-XXXX-4a9c-ae6d-be886cf1bacb2023-05-23T13:59:13.160+01:00    5    [Request: 187][HTTP Headers]HTTP Auth Scheme: 0User: Password: GET /carrier/api/shipment-listing/e0faca8c-XXXX-4a9c-ae6d-be886cf1bacb HTTP/1.1Host: api.XXXX.comAccept-Encoding: gzip, deflateUser-Agent: CData Data Provider Engine - www.cdata.com - Accepts: gzip`

`2023-05-23T13:59:13.847+01:00    5    [Response: 187]`

---

<div class="post-metadata">

**Author:** ![James\_B](https://sea3.discourse-cdn.com/cdata/user_avatar/community.cdata.com/james_b/32/1688_2.png) [@James\_B](https://community.cdata.com/u/James_B)\
**Post date:** [May 26, 2023, 4:25pm UTC](https://community.cdata.com/t/arc-httpget-operation-how-to-pass-authentication-bearer-header/193/11 "2023-05-26T16:25:57Z")

</div>

Hi Russel,

I believe that the problem here is that the arguments to the httpGet operation are different that what&nbsp; you are providing:

> **[CData Arc - httpGet | Version 22.0.8473](https://cdn.cdata.com/help/AZH/mft/op_HTTPGet.html)**

Instead of specifying the header with name as an argument to httpGet, you would provide both the name and values in a single array argument:

**header:name#** : The name for each custom header to pass with the request.  
**header:value#** : The value for each custom header to pass with the request.

So this&nbsp;code:

```xml
<arc:set attr="http.header:X-Custom" value="test"/> 

```

Actually needs to be:

```auto
<arc:set attr="http.header:name#" value="X-Custom" /><arc:set attr="http.header:value#" value="test"/> <!-- Other headers are appended to the array --><arc:set attr="http.header:name#" value="X-Custom-2" /><arc:set attr="http.header:value#" value="test2"/> 

```