# API Authentication Error

**URL:** <https://community.dreamfactory.com/t/api-authentication-error/880>\
**Category:** REST API\
**Created:** [February 24, 2015, 11:48pm UTC](https://community.dreamfactory.com/t/api-authentication-error/880 "2015-02-24T23:48:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tmbjohnson](https://avatars.discourse-cdn.com/v4/letter/t/c37758/32.png) [@tmbjohnson](https://community.dreamfactory.com/u/tmbjohnson)\
**Post date:** [February 24, 2015, 11:48pm UTC](https://community.dreamfactory.com/t/api-authentication-error/880/1 "2015-02-24T23:48:32Z")

</div>

Hi there. I am new to DreamFactory and I have created an app and service and I am just trying to get connected to the API endpoint I have created using AngularJS.

I can do a simple request to my API using Postman in Google Chrome by just adding Authorization and X-DreamFactory-Application-Name Headers with the relevant Base64 encoded username +’:’ + password and using the app name. This connects perfectly and returns JSON from my database.

In AngularJS however passing the same two headers I get an error about the Authroization header. If I remove it of course I get a CORS error.

```
XMLHttpRequest cannot load https://dsp-mydspname.cloud.dreamfactory.com/rest/portfolio/Project. Request header field Authorization is not allowed by Access-Control-Allow-Headers.

```

In Angular I am using this method to set the headers (using the same password that works using Postman:

```
$http.defaults.headers.common['Authorization'] = 'Basic dG1iam9obXXXXXFpbC5jb2XXXXXXXNdW0gTm8gXXXXXXM=';

```

I have guest users and CORS enabled and \* set for the GET method. Am I missing something?

---

<div class="post-metadata">

**Author:** ![tmbjohnson](https://avatars.discourse-cdn.com/v4/letter/t/c37758/32.png) [@tmbjohnson](https://community.dreamfactory.com/u/tmbjohnson)\
**Post date:** [February 25, 2015, 6:53am UTC](https://community.dreamfactory.com/t/api-authentication-error/880/2 "2015-02-25T06:53:55Z")

</div>

Resolved : There must have been a caching issue as I disabled the Authorization header again and now I get the return in the browser. Any insights into the correct process would be appreciated.