starred/uptime-kuma

Fork 0

mirror of https://github.com/louislam/uptime-kuma.git synced 2026-03-02 22:57:00 -05:00

API keys and creating a monitor #2503

New issue

Closed

opened 2026-02-28 02:57:04 -05:00 by deekerman · 5 comments

deekerman commented

2026-02-28 02:57:04 -05:00

Owner

Originally created by @anthonyra on GitHub (Aug 21, 2023).

⚠️ Please verify that this bug has NOT been raised before.

I checked and didn't find similar issue

🛡️ Security Policy

I agree to have read this project Security Policy

📝 Describe your problem

It appears that the socket.io API can be used to create monitors. Based on the wrapper here https://github.com/lucasheld/uptime-kuma-api/tree/master however I'm not sure if this falls under the scope of what the API keys can authorize?

Since I'm not sure if the socket.io API is considered one of the "secured HTTP APIs" as described in https://github.com/louislam/uptime-kuma/wiki/API-Keys or not...

I'm currently trying to install monitors with ansible-pull so the credentials could in theory be accessible on local storage of the host. I'd much rather it be the API key vs the admin user:password or JWT representing that same user.

📝 Error Message(s) or Log

No response

🐻 Uptime-Kuma Version

1.23.0

💻 Operating System and Arch

Ubuntu 22.04.2 LTS

🌐 Browser

Mozilla Firefox 116.0.3 (64-bit)

🐋 Docker Version

not using docker

🟩 NodeJS Version

18.17.1

Originally created by @anthonyra on GitHub (Aug 21, 2023). ### ⚠️ Please verify that this bug has NOT been raised before. - [X] I checked and didn't find similar issue ### 🛡️ Security Policy - [X] I agree to have read this project [Security Policy](https://github.com/louislam/uptime-kuma/security/policy) ### 📝 Describe your problem It appears that the socket.io API can be used to create monitors. Based on the wrapper here <https://github.com/lucasheld/uptime-kuma-api/tree/master> however I'm not sure if this falls under the scope of what the API keys can authorize? Since I'm not sure if the socket.io API is considered one of the "secured HTTP APIs" as described in <https://github.com/louislam/uptime-kuma/wiki/API-Keys> or not... I'm currently trying to install monitors with `ansible-pull` so the credentials could in theory be accessible on local storage of the host. I'd much rather it be the API key vs the admin user:password or JWT representing that same user. ### 📝 Error Message(s) or Log _No response_ ### 🐻 Uptime-Kuma Version 1.23.0 ### 💻 Operating System and Arch Ubuntu 22.04.2 LTS ### 🌐 Browser Mozilla Firefox 116.0.3 (64-bit) ### 🐋 Docker Version not using docker ### 🟩 NodeJS Version 18.17.1

deekerman

2026-02-28 02:57:04 -05:00

closed this issue
added the
Stale

help
labels

deekerman commented

2026-02-28 02:57:10 -05:00

Author

Owner

@Computroniks commented on GitHub (Aug 21, 2023):

API keys currently only cover the Prometheus /metrics endpoint

@Computroniks commented on GitHub (Aug 21, 2023): API keys currently only cover the Prometheus /metrics endpoint

deekerman commented

2026-02-28 02:57:10 -05:00

Author

Owner

@anthonyra commented on GitHub (Aug 21, 2023):

Ahh is there a chance for there to be support on the socket.io side?

@anthonyra commented on GitHub (Aug 21, 2023): Ahh is there a chance for there to be support on the socket.io side?

deekerman commented

2026-02-28 02:57:10 -05:00

Author

Owner

@CommanderStorm commented on GitHub (Aug 21, 2023):

No, not in the immediate term, because this would invalidate

The API key cannot be used to access the web interface

=> Allowing more access to api keys requires a permission system.
=> see #128 and #118 for plans to get there.

If you want to help with this feature, here is our contribution guide:
https://github.com/louislam/uptime-kuma/blob/master/CONTRIBUTING.md

@CommanderStorm commented on GitHub (Aug 21, 2023): No, not in the immediate term, because this would invalidate > The API key cannot be used to access the web interface => Allowing more access to api keys requires a permission system. => see #128 and #118 for plans to get there. If you want to help with this feature, here is our contribution guide: https://github.com/louislam/uptime-kuma/blob/master/CONTRIBUTING.md

deekerman commented

2026-02-28 02:57:10 -05:00

Author

Owner

@github-actions[bot] commented on GitHub (Nov 19, 2023):

We are clearing up our old issues and your ticket has been open for 3 months with no activity. Remove stale label or comment or this will be closed in 2 days.

@github-actions[bot] commented on GitHub (Nov 19, 2023): We are clearing up our old issues and your ticket has been open for 3 months with no activity. Remove stale label or comment or this will be closed in 2 days.

deekerman commented

2026-02-28 02:57:10 -05:00

Author

Owner

@github-actions[bot] commented on GitHub (Nov 21, 2023):

This issue was closed because it has been stalled for 2 days with no activity.

@github-actions[bot] commented on GitHub (Nov 21, 2023): This issue was closed because it has been stalled for 2 days with no activity.