API ignores basic auth (for creating API key)

[lonix1]

Description

I am using ansible to provision a gitea server and configure it. I created an admin account using the CLI.

There are some things that can only be done with the API, but to use it one needs an API key. And I can't do that manually - I want to automate that.

So using basic auth, I tried:

curl -X POST \
  'http://localhost:3000/api/v1/users/username/tokens' \
  -H 'accept: application/json' \
  -H 'Content-Type: application/json' \
  -u username:password \
  -d '{ "name": "hello" }'

Error:

Only signed in user is allowed to call APIs.

So I tried in the swagger interface. In the auth popup I entered username/password for the basic auth option, then I tried the endpoint. Result:

Only signed in user is allowed to call APIs.

I double checked my syntax with the docs here, and it seems correct. And my username/password is correct as I use it in the gitea frontend.

Gitea Version

1.20.0-rc2

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

linux

How are you running Gitea?

docker rootful

Database

SQLite

[lonix1]

This is not documented, but is possible via the CLI:

$ gitea admin user generate-access-token --username username --token-name hello

Thanks to @delvh for letting me know in the discord chat!

[delvh]

By the way, docs PR are always welcome, if you want to improve the documentation.

[lonix1]

LOL - I just submitted a PR, this second! #25504