Postman for login post API returning 'could not authenticate'

1. What is the issue? Please be detailed.
Using postman to send the login request to https://{{ODK_SERVER}}/v1/sessions.
Body (JSON):
{
"email": "EMAIL_ID",
"password": "PASSWORD"
}

This worked earlier, and i saved it as part of the Postman collection.

The response i am getting now is
{
"message": "Could not authenticate with the provided credentials.",
"code": 401.2
}

The same credential is working fine for web login.

2. What steps can we take to reproduce this issue?
Not sure.

3. What have you tried to fix the issue?
Use a different cred but still the same response.

4. Upload any forms or screenshots you can share publicly below.

Hi @atanu ! :smile:

I guess, it's simple. How can you login again when you are already login-ed into ODK Central? Tap on the "cookies" available on the top right, delete the stored cookies for odkapi.capibuilder.org, and then retry the request. It will return the new token. :sweat_smile:

Great day ahead! :smile:

1 Like

Well, not really - these are different clients - one is postman, ODK Central itself and CAPIBuilder react app. ODK Central is not currently preventing log in using multiple clients.

For example, the postman has no other session open (screenshot below). Consequently, it didn't store any cookie either (in postman client).

One possibility is ofcourse server is preventing access from postman client, but then the response shouldn't be cred error.

It was working a few days earlier, i know its wired behavior.

Here, a short demo, I feel like cookies itself is an issue here. Disabling cookie jar will keep on generating new tokens on each request. But, just out of curiosity, I still wonder, why re-run this request and generate new tokens (as each token's already valid for 24 hours if I am not wrong, unless terminated otherwise)? :thinking:

postman-odk-session-test

1 Like

Yes, cookie was set beforehand, must have logged in that window.

1 Like

If you don't mind, the reason i stumbled across the authentication issue to send a post request following documentation for entities and datasets:

Creating Datasets

Creating Entities

The cookie is already set in the login tab in Postman. Now i am sending this request body (provided in the docs) for creating entities (also creating datasets):

{
  "entities": [
    {
      "uuid": "54a405a0-53ce-4748-9788-d23a30cc3afa",
      "label": "John Doe (22)",
      "data": {
        "firstName": "John",
        "age": "22"
      }
    },
    {
      "uuid": "0c3a7922-b611-42ca-a961-944e09fa9aa2",
      "label": "Amy Jane (38)",
      "data": {
        "firstName": "Amy",
        "age": "38"
      }
    }
  ]
 
}

Example post endpoint for creating entities is: https://odkapi.capibuilder.org/v1/projects/13/datasets/people/entities

In both cases, i am getting back this response

{
    "message": "Could not authenticate with the provided credentials.",
    "code": 401.2
}

screenshot below

Any approach to posting datasets and entities?

why not using basic auth at Authorization?

I followed ODK auth method:

Post login cred using login REST API endpoint.
ODK issues cookie and sets in the client (in this case Postman)
All other subsequent requests (such as GET/POST entities and datasets in this case) will use the cookie.

This test results in the same auth error for the older ODK Central version (v23.05) and the latest (v2024.3).

Hi @atanu ! :smile:

First of all, I am sorry for the late response. Got caught up with some work & the holiday season..! Btw, Merry Christmas (I know it was a few days ago, but anyways..)!!

So, yes, it is possible to create entities using Postman. There are two ways!

  1. Using token (the way we were already doing it).
  2. As @chun_hing_yap suggested, using basic auth.

Let's see both of the approaches!

Before we begin with any of those approaches, I would like you to setup a new "Collection" (let's call it "ODK_Requests") in the Postman. Once done, go to the "Variables" section (or tab) of the "ODK_Requests" Collection and setup and save (yes! It is very important to save!) the following variables:

You will be adding "base_url" which will contain https://odkapi.capibuilder.org, "my_email" and "my_password" will contain your ODK Central email & pass. "project_id" will be 13 and "entity_name" will be people in your case.

Save it! And, follow along! :smile:

Approach 01: Using Token

  1. Create a new POST request (let's call it "Authenticate") in the ODK_Requests collection. This request will be the same one we were using to generate the token. It will look something like:

  1. Under request "Settings" tab, disable the cookie jar (the one I shared a short demo for).
  2. And, under the "Scripts" tab, add the following .js script in "Post-Response" section:
if (pm.response.code === 200) {  
    const jsonRes = pm.response.json();  
    const token = jsonRes.token;  
    pm.collectionVariables.set("authToken", token);  
} else {  
    console.error("Request failed with status:", pm.response.code);  
}

Will look something like:

  1. We are done, save the request and send it once. You should receive a token. Doing this should have automatically added a new variable (authToken) in "ODK_Requests" collection's Variable list (along with the one we added manually earlier).
  2. Create a new POST request, let's call it "AddEntity", it will look something like this:

  1. Under the "Authorization" tab in the "AddEntity" POST request, add a Bearer token variable (authToken - the one we generated above). It will look something like:

  1. Done! Save and send this request, a new entity record will be added to the dataset.

Note: It's enough to send an "Authenticate" request once every 24 hours (as each token is valid for 24 hours in general). You may proceed with sending multiple entity addition ("AddEntity") requests as convenient using a single token itself. You may also send multiple entity records to be added within a single request.

Alright! Let's check the second approach.

Approach 02: Using Basic Auth

  1. When using this, we can simply delete the "Authenticate" POST request we created / saved during the first approach.
  2. Under the "Authorization" tab in the "AddEntity" POST request, select the "Auth Type" as "Basic Auth", and add variables storing your ODK Central user and pass. It will look something like:

  1. Done! Save the request and send it as necessary!

Why two different alternative approaches and which one should you be using?
Well, it depends on the use-case. In general, we use the Bearer Token thing when we expect higher privacy or security in our request-response communication within the production environment, as it protects our credentials. And, we prefer using the Basic Auth thing in the development environment where we really aren't very concerned about the privacy or the security of our credentials maybe.

I guess, that would be all..!

Wishing you a very Happy New Year - 2025, in advance! :smile:

See ya! Let me know! :smile:

3 Likes

Appreciate @MinimalPotato for your detailed response and time spent in creating/ sharing the scripts. The flow is well-understood for accessing datasets/ entity and method to access.

yes, datasets/ entity cant be indepdently accessed (which i was kinda of expecting), it has to be accessed through regular form creation API.

Happy holidays to you to and new years greetings.

1 Like