# Can a session token be generated in pure HTTP? **URL:** \ **Category:** Authentication & Security\ **Created:** [December 21, 2015, 6:36pm UTC](https://community.dreamfactory.com/t/can-a-session-token-be-generated-in-pure-http/1949 "2015-12-21T18:36:37Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![charliefinale](https://avatars.discourse-cdn.com/v4/letter/c/2acd7d/32.png) [@charliefinale](https://community.dreamfactory.com/u/charliefinale)\ **Post date:** [December 21, 2015, 6:36pm UTC](https://community.dreamfactory.com/t/can-a-session-token-be-generated-in-pure-http/1949/1 "2015-12-21T18:36:37Z")
Hi All I want to simplify a few things for the coders and avoid headers. Can we create session tokens like this? [http://xxx.xxx.xx.xxx/api/v2/user/session?method=get&api\_key=4d18fd67a5d1ffce16dxxxxxxxxxxxxxxxxx&email=user@myemail.com&password=user123&duration=20&accept=json](http://xxx.xxx.xx.xxx/api/v2/user/session?method=get&api_key=4d18fd67a5d1ffce16dxxxxxxxxxxxxxxxxx&email=user@myemail.com&password=user123&duration=20&accept=json) If so, why does the above not work? And also if so, can everything be done using only http? Many thanks for all your help on this forum, it is great. Charlie ---
**Author:** ![kimpatro](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.dreamfactory.com/kimpatro/32/467_2.png) [@kimpatro](https://community.dreamfactory.com/u/kimpatro)\ **Post date:** [December 22, 2015, 10:31am UTC](https://community.dreamfactory.com/t/can-a-session-token-be-generated-in-pure-http/1949/2 "2015-12-22T10:31:14Z")
Take a look at: [https://wiki.dreamfactory.com/DreamFactory/API#API\_Key](https://wiki.dreamfactory.com/DreamFactory/API#API_Key) (Thanks @juniorconte for the tip.) ---
**Author:** ![charliefinale](https://avatars.discourse-cdn.com/v4/letter/c/2acd7d/32.png) [@charliefinale](https://community.dreamfactory.com/u/charliefinale)\ **Post date:** [December 28, 2015, 3:54pm UTC](https://community.dreamfactory.com/t/can-a-session-token-be-generated-in-pure-http/1949/3 "2015-12-28T15:54:02Z")
I believe the answer to my question is currently “no” because according to this post parameters are not accepted in the url - only in the headers. Can someone correct me if I am mistaken? > [@URL Parameter "accept" not working?](https://community.dreamfactory.com/t/url-parameter-accept-not-working/1954/2): > > @Reto Sorry for the confusion, it looks like that wiki page was mistakenly updated by myself with stuff coming in the next release. The Accept header is currently working, but no the URL param. Stay tuned. ---
**Author:** ![formerstaff](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.dreamfactory.com/formerstaff/32/1133_2.png) [@formerstaff](https://community.dreamfactory.com/u/formerstaff)\ **Post date:** [December 28, 2015, 4:07pm UTC](https://community.dreamfactory.com/t/can-a-session-token-be-generated-in-pure-http/1949/4 "2015-12-28T16:07:50Z")
You are correct that your scenario is not workable. To create a session, you must POST to user/session with a POST payload that includes the user’s email and password ---
**Author:** ![charliefinale](https://avatars.discourse-cdn.com/v4/letter/c/2acd7d/32.png) [@charliefinale](https://community.dreamfactory.com/u/charliefinale)\ **Post date:** [December 28, 2015, 4:11pm UTC](https://community.dreamfactory.com/t/can-a-session-token-be-generated-in-pure-http/1949/5 "2015-12-28T16:11:10Z")
OK, no worries and with thanks. And then even if we have POSTed to get the session token we still cannot use a URL only because the params need to be in the header too right? ---
**Author:** ![formerstaff](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.dreamfactory.com/formerstaff/32/1133_2.png) [@formerstaff](https://community.dreamfactory.com/u/formerstaff)\ **Post date:** [December 28, 2015, 4:48pm UTC](https://community.dreamfactory.com/t/can-a-session-token-be-generated-in-pure-http/1949/6 "2015-12-28T16:48:14Z")
You can pass the api key and session token in the URL as parameters rather than headers. ex:`http://myurl/api/v2/db/_table/todo?api_key=myapikey&session_token=mysessiontoken` ---
**Author:** ![charliefinale](https://avatars.discourse-cdn.com/v4/letter/c/2acd7d/32.png) [@charliefinale](https://community.dreamfactory.com/u/charliefinale)\ **Post date:** [December 29, 2015, 4:44am UTC](https://community.dreamfactory.com/t/can-a-session-token-be-generated-in-pure-http/1949/7 "2015-12-29T04:44:54Z")
Thanks Drew, you are right, and I tested it. After the session token is generated, a heck of lot of data can be consumed in http without the need for posting headers. So as a simple url does the trick in most cases.