Authentication
Eranio
Authentication
Every request needs the header X-Admin-Token with the token of the mod.
X-Admin-Token: 1b4e28ba-2fa1-11d2-883f-0016d3cca427
Where the token comes from
On the first start the mod creates mods/Eranio_HytaleAdminAPI/config.json with a random UUID as token. Change it there and restart the server to use another token. The Pelican plugin reads the token from this file itself.
Example
curl -H 'X-Admin-Token: YOUR_TOKEN' http://localhost:5550/api/status
Responses
| Status | Meaning |
|---|---|
200 |
Accepted (check success in the body for actions) |
204 |
CORS preflight (OPTIONS), no token needed |
403 |
Missing or wrong token, body {"error": "Forbidden"} |
The comparison is timing-safe. There is no IP filter in the mod itself.
Recommendations
- Bind to
127.0.0.1if the panel runs on the same machine, otherwise allow the port only for the panel IP in the firewall - Never put the token into browser code
- Use a reverse proxy with HTTPS if the API has to be reachable over the internet