<commit_before>---
title: Authentication and authorization in InfluxDB
aliases:
    - influxdb/v1.7/administration/authentication_and_authorization/
menu:
  influxdb_1_7:
    name: Authentication and authorization
    weight: 20
    parent: Administration
---

This document covers setting up and managing authentication and authorization in InfluxDB.

<table style="width:100%">
  <tr>
    <td><a href="#authentication">Authentication:</a></td>
    <td><a href="#authorization">Authorization:</a></td>
  </tr>
  <tr>
    <td><a href="#set-up-authentication">Set up Authentication</a></td>
    <td><a href="#user-types-and-privileges">User Types and Privileges</a></td>
  </tr>
  <tr>
    <td><a href="#authenticate-requests">Authenticate Requests</a></td>
    <td><a href="#user-management-commands">User Management Commands</a></td>
  </tr>
  <tr>
      <td><a href="#authentication-and-authorization-http-errors">HTTP Errors</a></td>
      <td><a href="#authentication-and-authorization-http-errors">HTTP Errors</a></td>
  </tr>
</table>

> **Note:** Authentication and authorization should not be relied upon to prevent access and protect data from malicious actors.
If additional security or compliance features are desired, InfluxDB should be run behind a third-party service.

## Authentication

InfluxDB's HTTP API and the [command line interface](/influxdb/v1.7/tools/shell/) (CLI), which connects to the database using the API, include simple, built-in authentication based on user credentials.
When you enable authentication, InfluxDB only executes HTTP requests that are sent with valid credentials.


> **Note:** Authentication only occurs at the HTTP request scope.
Plugins do not currently have the ability to authenticate requests and service endpoints (for example, Graphite, collectd, etc.) are not authenticated.

### Set up authentication

#### 1. Create at least one [admin user](#admin-users).
See the [authorization section](#authorization) for how to create an admin user.

> **Note:** If you enable authentication and have no users, InfluxDB will **not** enforce authentication and will only accept the [query](#user-management-commands) that creates a new admin user.

InfluxDB will enforce authentication once there is an admin user.

#### 2. By default, authentication is disabled in the configuration file.
Enable authentication by setting the `auth-enabled` option to `true` in the `[http]` section of the configuration file:

```
[http]
  enabled = true
  bind-address = ":8086"
  auth-enabled = true # ✨
  log-enabled = true
  write-tracing = false
  pprof-enabled = false
  https-enabled = true
  https-certificate = "/etc/ssl/influxdb.pem"
```

#### 3. Restart the process

Now InfluxDB will check user credentials on every request and will only process requests that have valid credentials for an existing user.

### Authenticate requests

#### Authenticate with the HTTP API
There are two options for authenticating with the [HTTP API](/influxdb/v1.7/tools/api/).

If you authenticate with both Basic Authentication **and** the URL query parameters, the user credentials specified in the query parameters take precedence.
The queries in the following examples assume that the user is an [admin user](#admin-users).
See the section on [authorization](#authorization) for the different user types, their privileges, and more on user management.

> **Note:** InfluxDB redacts passwords when you enable authentication.

##### Authenticate with Basic Authentication as described in [RFC 2617, Section 2](http://tools.ietf.org/html/rfc2617)
<br>
This is the preferred method for providing user credentials.

Example:

```bash
curl -G http://localhost:8086/query -u todd:influxdb4ever --data-urlencode "q=SHOW DATABASES"
```

##### Authenticate by providing query parameters in the URL or request body

Set `u` as the username and `p` as the password.

###### Example using query parameters

```bash
curl -G "http://localhost:8086/query?u=todd&p=influxdb4ever" --data-urlencode "q=SHOW DATABASES"
```

###### Example using request body

```bash
curl -G http://localhost:8086/query --data-urlencode "u=todd" --data-urlencode "p=influxdb4ever" --data-urlencode "q=SHOW DATABASES"
```

#### Authenticate with the CLI
There are three options for authenticating with the [CLI](/influxdb/v1.7/tools/shell/).

##### Authenticate with the `INFLUX_USERNAME` and `INFLUX_PASSWORD` environment variables

Example:

```bash
export INFLUX_USERNAME todd
export INFLUX_PASSWORD in<PASSWORD>
echo $INFLUX_USERNAME $INFLUX_PASSWORD
todd influxdb<PASSWORD>

influx
Connected to http://localhost:8086 version 1.4.x
InfluxDB shell 1.4.x
```

##### Authenticate by setting the `username` and `password` flags when you start the CLI

Example:

```bash
influx -username todd -password <PASSWORD>
Connected to http://localhost:8086 version 1.4.x
InfluxDB shell 1.4.x
```

##### Authenticate with `auth <username> <password>` after starting the CLI<commit_msg>Add missing equals in export commands<commit_after>---
title: Authentication and authorization in InfluxDB
aliases:
    - influxdb/v1.7/administration/authentication_and_authorization/
menu:
  influxdb_1_7:
    name: Authentication and authorization
    weight: 20
    parent: Administration
---

This document covers setting up and managing authentication and authorization in InfluxDB.

<table style="width:100%">
  <tr>
    <td><a href="#authentication">Authentication:</a></td>
    <td><a href="#authorization">Authorization:</a></td>
  </tr>
  <tr>
    <td><a href="#set-up-authentication">Set up Authentication</a></td>
    <td><a href="#user-types-and-privileges">User Types and Privileges</a></td>
  </tr>
  <tr>
    <td><a href="#authenticate-requests">Authenticate Requests</a></td>
    <td><a href="#user-management-commands">User Management Commands</a></td>
  </tr>
  <tr>
      <td><a href="#authentication-and-authorization-http-errors">HTTP Errors</a></td>
      <td><a href="#authentication-and-authorization-http-errors">HTTP Errors</a></td>
  </tr>
</table>

> **Note:** Authentication and authorization should not be relied upon to prevent access and protect data from malicious actors.
If additional security or compliance features are desired, InfluxDB should be run behind a third-party service.

## Authentication

InfluxDB's HTTP API and the [command line interface](/influxdb/v1.7/tools/shell/) (CLI), which connects to the database using the API, include simple, built-in authentication based on user credentials.
When you enable authentication, InfluxDB only executes HTTP requests that are sent with valid credentials.


> **Note:** Authentication only occurs at the HTTP request scope.
Plugins do not currently have the ability to authenticate requests and service endpoints (for example, Graphite, collectd, etc.) are not authenticated.

### Set up authentication

#### 1. Create at least one [admin user](#admin-users).
See the [authorization section](#authorization) for how to create an admin user.

> **Note:** If you enable authentication and have no users, InfluxDB will **not** enforce authentication and will only accept the [query](#user-management-commands) that creates a new admin user.

InfluxDB will enforce authentication once there is an admin user.

#### 2. By default, authentication is disabled in the configuration file.
Enable authentication by setting the `auth-enabled` option to `true` in the `[http]` section of the configuration file:

```
[http]
  enabled = true
  bind-address = ":8086"
  auth-enabled = true # ✨
  log-enabled = true
  write-tracing = false
  pprof-enabled = false
  https-enabled = true
  https-certificate = "/etc/ssl/influxdb.pem"
```

#### 3. Restart the process

Now InfluxDB will check user credentials on every request and will only process requests that have valid credentials for an existing user.

### Authenticate requests

#### Authenticate with the HTTP API
There are two options for authenticating with the [HTTP API](/influxdb/v1.7/tools/api/).

If you authenticate with both Basic Authentication **and** the URL query parameters, the user credentials specified in the query parameters take precedence.
The queries in the following examples assume that the user is an [admin user](#admin-users).
See the section on [authorization](#authorization) for the different user types, their privileges, and more on user management.

> **Note:** InfluxDB redacts passwords when you enable authentication.

##### Authenticate with Basic Authentication as described in [RFC 2617, Section 2](http://tools.ietf.org/html/rfc2617)
<br>
This is the preferred method for providing user credentials.

Example:

```bash
curl -G http://localhost:8086/query -u todd:influxdb4ever --data-urlencode "q=SHOW DATABASES"
```

##### Authenticate by providing query parameters in the URL or request body

Set `u` as the username and `p` as the password.

###### Example using query parameters

```bash
curl -G "http://localhost:8086/query?u=todd&p=influxdb4ever" --data-urlencode "q=SHOW DATABASES"
```

###### Example using request body

```bash
curl -G http://localhost:8086/query --data-urlencode "u=todd" --data-urlencode "p=influxdb4ever" --data-urlencode "q=SHOW DATABASES"
```

#### Authenticate with the CLI
There are three options for authenticating with the [CLI](/influxdb/v1.7/tools/shell/).

##### Authenticate with the `INFLUX_USERNAME` and `INFLUX_PASSWORD` environment variables

Example:

```bash
export INFLUX_USERNAME=todd
export INFLUX_PASSWORD=<PASSWORD>
echo $INFLUX_USERNAME $INFLUX_PASSWORD
todd influxdb4ever

influx
Connected to http://localhost:8086 version 1.4.x
InfluxDB shell 1.4.x
```

##### Authenticate by setting the `username` and `password` flags when you start the CLI

Example:

```bash
influx -username todd -password <PASSWORD>
Connected to http://localhost:8086 version 1.4.x
InfluxDB shell 1.4.x
```

##### Authenticate with `auth <username> <password>` after starting the CLI
{'fraction_non_alphanumeric': 0.11543489190548015, 'fraction_numerical': 0.01256913021618904, 'mean_word_length': 4.809579439252336, 'pattern_counts': {'":': 2, '<': 98, '<?xml version=': 0, '>': 106, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1220698', 'n_tokens_mistral': 3041, 'n_tokens_neox': 2841, 'n_words': 1076}