# Authorization token in ajax request

**URL:** <https://forums.losant.com/t/authorization-token-in-ajax-request/1928>\
**Category:** Help\
**Tags:** workflow\
**Created:** [June 26, 2019, 5:42pm UTC](https://forums.losant.com/t/authorization-token-in-ajax-request/1928 "2019-06-26T17:42:51Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![nahuel](https://avatars.discourse-cdn.com/v4/letter/n/8dc957/32.png) [@nahuel](https://forums.losant.com/u/nahuel)\
**Post date:** [June 26, 2019, 5:42pm UTC](https://forums.losant.com/t/authorization-token-in-ajax-request/1928/1 "2019-06-26T17:42:51Z")

</div>

Hi there,

I’m trying to trigger a virtual button from an ajax request.  
I tried it with postman and it works.

Now, I want to use cookies (set when user logged in to something like [my-page.onlosant.com](http://my-page.onlosant.com)) to make that request. How do I add authorization cookie to ajax request? This is what I have so far.

```auto
var token = (what should go here?);
$.ajax({
  url: "https://api.losant.com/applications/5cbf31a04c061e0009dc85b1/flows/5cfec6e21930a50008279dfa/virtualButton",
  type: "POST",
  headers: {
    "Content-Type": "application/json",
    "Accept": "application/json",
    "Authorization": "Bearer"+token
  },
  data: {
    "key": "5cfec6e21930a50008279dfa-lPWOBslkG7xNqZId_QGqK",
    "payload": {
      "some": "data"
    }
  },
  success: function(result){
    console.log(result);
    // GUI - notificacion
    $.notify("Acción realizada con éxito", { position: "bottom center", style: 'bootstrap', className: 'success' });
  },
  error: function(result){console.log(result);}
});

```

Regards,  
Nahuel

---

<div class="post-metadata">

**Author:** ![Brandon\_Cannaday](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/brandon_cannaday/32/14_2.png) [@Brandon\_Cannaday](https://forums.losant.com/u/Brandon_Cannaday)\
**Post date:** [June 26, 2019, 6:00pm UTC](https://forums.losant.com/t/authorization-token-in-ajax-request/1928/2 "2019-06-26T18:00:13Z")

</div>

Hey Nahuel,

Making requests directly against the Losant API cannot be made by an Experience User’s authentication token. The tokens provided by Experience Users (i.e. logged in via [onlosant.com](http://onlosant.com) page) are used for identification and authentication when they make requests against Experience Endpoints.

The Losant API provides broad access to an application’s resources, and it’s not likely a level of access you want to expose to your Experience Users. This is why we introduced the Experience Endpoint system as a layer above the Losant API. Endpoints allow you to handle and validate requests based on your application’s own security requirements.

It is a perfectly acceptable use-case to allow an Experience User to trigger a Virtual Button, however you’ll have to move the button invocation into a Workflow triggered by an Experience Endpoint. So the ajax call will not directly request the Losant API, it will instead request an Experience Endpoint. The Workflow that’s triggered by that endpoint can then use the [Losant API Node](https://docs.losant.com/workflows/data/losant-api/) to do what you’re trying to do directly. This extra layer then gives you an opportunity to make sure the user attempting this action is allowed to do it.

---

<div class="post-metadata">

**Author:** ![Brandon\_Cannaday](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/brandon_cannaday/32/14_2.png) [@Brandon\_Cannaday](https://forums.losant.com/u/Brandon_Cannaday)\
**Post date:** [June 26, 2019, 6:04pm UTC](https://forums.losant.com/t/authorization-token-in-ajax-request/1928/3 "2019-06-26T18:04:02Z")

</div>

Also, when making ajax calls to Endpoints, the user’s token is automatically provided since it’s put in a cookie by the Login workflow. So your code would look something like this:

```auto
$.ajax({
            url: "https://my-page.onlosant.com/my-custom-endpoint",
            type: "POST",
            headers: {
              "Content-Type": "application/json",
              "Accept": "application/json"
            },
            data: {
              "some": "data"
            },
            success: function(result){
              console.log(result);
              // GUI - notificacion
              $.notify("Acción realizada con éxito", { position: "bottom center", style: 'bootstrap', className: 'success' });
            },
            error: function(result){console.log(result);}
          });

```

---

<div class="post-metadata">

**Author:** ![Brandon\_Cannaday](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/brandon_cannaday/32/14_2.png) [@Brandon\_Cannaday](https://forums.losant.com/u/Brandon_Cannaday)\
**Post date:** [June 26, 2019, 6:07pm UTC](https://forums.losant.com/t/authorization-token-in-ajax-request/1928/4 "2019-06-26T18:07:39Z")

</div>

And here’s an example workflow that shows how to use the Losant API Node to press the button:

![image](https://us1.discourse-cdn.com/flex015/uploads/getstructure/original/2X/3/3335555d1e788edfe29aca187d0e79b3bade7525.png)

---

<div class="post-metadata">

**Author:** ![nahuel](https://avatars.discourse-cdn.com/v4/letter/n/8dc957/32.png) [@nahuel](https://forums.losant.com/u/nahuel)\
**Post date:** [June 26, 2019, 8:00pm UTC](https://forums.losant.com/t/authorization-token-in-ajax-request/1928/5 "2019-06-26T20:00:40Z")

</div>

Thanks, Brandon for your quick and detailed answer. Got it working 😄