Mango REST API "Special Key"

---

Hello,

TL;DR: I need the API Special Key to proceed (I think).

I'm trying to create a method in PHP to make an API call to a remote server via a CURL call. I've had success with other APIs (twitter, instagram, facebook), but am lacking some fine detail I think with the Mango server.

It appears that when I make (what I would consider) a valid API call, it is rejected (401). I can make Javascript API calls just fine, but I want to do some behind the scenes stuff. I may want the server that displays the information separate from the Mango server for redundancy.

Most of the issues SEEM to come from "not being logged in." I want to have a secure system, so I was using user:password with basic auth, oauth, anything I could try to no avail. There is a portion of the documentation that seems to MENTION an API Special Key (Swagger UI home page, on the top: Mango Automation at http://infiniteautomation.com we need to define an api key "special-key" to test the authorization filters)

I tried typing in some nonsense into the api_key field, and it started automatically outputting it into the "Try it!" results, which I'm assuming is NOT correct (need to find the key elsewhere and paste it in there probably).

Anyways, I can't find the API key anywhere. I think this might solve my problem. Using 2.6 beta version currently, will update to whatever.

There are a few things you need to know about using our REST api from a host other than Mango.

1. You will need to setup the CORS filter to allow cross site requests into Mango. You will need to allow all the various headers that you want to use. Checkout the classes/mangoApiHeaders.properties and the web/dox folder to see how the override-web.xml file should work. Be careful as the early releases of 2.6.0 beta have this filed named web-override.xml (which is wrong).

2. You will need to use the REST api to login to Mango via your remote server and then retain the session cookie to pass back to mango on any future requests.

3. Be sure to include the password header in the CORS configuration as you will most likely need to use this to login.

In the future we are planning to use OAUTH but this has not been a high priority for us yet.