# How to use digest authentication in httpBinding **URL:** \ **Category:** Ignition\ **Tags:** perspective\ **Created:** [January 4, 2024, 12:56pm UTC](https://forum.inductiveautomation.com/t/how-to-use-digest-authentication-in-httpbinding/83786 "2024-01-04T12:56:34Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Andrii\_Ushchapovskyi](https://avatars.discourse-cdn.com/v4/letter/a/a3d4f5/32.png) [@Andrii\_Ushchapovskyi](https://forum.inductiveautomation.com/u/Andrii_Ushchapovskyi)\ **Post date:** [January 4, 2024, 12:56pm UTC](https://forum.inductiveautomation.com/t/how-to-use-digest-authentication-in-httpbinding/83786/1 "2024-01-04T12:56:34Z")
I can't understand where I should write down username and password? Everytime I get 401 Unauthorized error as response. ---
**Author:** ![Transistor](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/transistor/32/3380_2.png) [@Transistor](https://forum.inductiveautomation.com/u/Transistor)\ **Post date:** [January 4, 2024, 1:46pm UTC](https://forum.inductiveautomation.com/t/how-to-use-digest-authentication-in-httpbinding/83786/2 "2024-01-04T13:46:24Z")
I've never looked into this before. What would you use as the URL if you were entering directly in your browser? ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [January 4, 2024, 1:51pm UTC](https://forum.inductiveautomation.com/t/how-to-use-digest-authentication-in-httpbinding/83786/3 "2024-01-04T13:51:05Z")
Digest auth requires the credentials to be encoded in request headers, if I recall correctly. (Encoded, not just supplied.) You'll have to look up the HTTP standards for how to do this, if no one has it off the top of their heads. (I do not.) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 4, 2024, 1:53pm UTC](https://forum.inductiveautomation.com/t/how-to-use-digest-authentication-in-httpbinding/83786/4 "2024-01-04T13:53:51Z")
Unfortunately it looks like digest authentication is not supported in either the binding or system.net.httpClient. ---
**Author:** ![Andrii\_Ushchapovskyi](https://avatars.discourse-cdn.com/v4/letter/a/a3d4f5/32.png) [@Andrii\_Ushchapovskyi](https://forum.inductiveautomation.com/u/Andrii_Ushchapovskyi)\ **Post date:** [January 4, 2024, 2:21pm UTC](https://forum.inductiveautomation.com/t/how-to-use-digest-authentication-in-httpbinding/83786/5 "2024-01-04T14:21:48Z")
It is very strange. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/3/4/34230d7113994a683f1f8f538f59bdc34b8f08f9.png) Because I can choose such authentication type in binding ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 4, 2024, 2:24pm UTC](https://forum.inductiveautomation.com/t/how-to-use-digest-authentication-in-httpbinding/83786/6 "2024-01-04T14:24:36Z")
Hmm, I must have misunderstood the ticket I found for this. I guess you have to put the precomputed value there, rather than supplying a username/password and it being computed for you. (I'm not really sure how this is supposed to be obtained unless you end up making a digest-authenticated request from another HTTP client / tool and just copy it in) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 4, 2024, 2:32pm UTC](https://forum.inductiveautomation.com/t/how-to-use-digest-authentication-in-httpbinding/83786/7 "2024-01-04T14:32:39Z")
Yeah, I'm gonna go ahead and stand by my original response... despite its appearance in the UI, it's essentially unsupported. It shouldn't be there. ---
**Author:** ![Andrii\_Ushchapovskyi](https://avatars.discourse-cdn.com/v4/letter/a/a3d4f5/32.png) [@Andrii\_Ushchapovskyi](https://forum.inductiveautomation.com/u/Andrii_Ushchapovskyi)\ **Post date:** [January 4, 2024, 2:51pm UTC](https://forum.inductiveautomation.com/t/how-to-use-digest-authentication-in-httpbinding/83786/8 "2024-01-04T14:51:54Z")
Oh, ok. So it is also necessary to remove the mention of this in the documentation [https://docs.inductiveautomation.com/display/DOC81/HTTP+Bindings+in+Perspective](https://docs.inductiveautomation.com/display/DOC81/HTTP+Bindings+in+Perspective) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 4, 2024, 2:54pm UTC](https://forum.inductiveautomation.com/t/how-to-use-digest-authentication-in-httpbinding/83786/9 "2024-01-04T14:54:31Z")
Yes. ---
**Author:** ![Transistor](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/transistor/32/3380_2.png) [@Transistor](https://forum.inductiveautomation.com/u/Transistor)\ **Post date:** [January 4, 2024, 3:51pm UTC](https://forum.inductiveautomation.com/t/how-to-use-digest-authentication-in-httpbinding/83786/10 "2024-01-04T15:51:58Z")
There's a link at the bottom of each doc page: > Found a problem? Send us an email: [docs@inductiveautomation.com](mailto:docs@inductiveautomation.com) ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 4, 2024, 3:53pm UTC](https://forum.inductiveautomation.com/t/how-to-use-digest-authentication-in-httpbinding/83786/11 "2024-01-04T15:53:57Z")
I've also opened a ticket for this and mentioned both the configuration UI and the user manual. ---
**Author:** ![Cameron\_Nickle](https://avatars.discourse-cdn.com/v4/letter/c/b3f665/32.png) [@Cameron\_Nickle](https://forum.inductiveautomation.com/u/Cameron_Nickle)\ **Post date:** [February 6, 2024, 6:25pm UTC](https://forum.inductiveautomation.com/t/how-to-use-digest-authentication-in-httpbinding/83786/12 "2024-02-06T18:25:16Z")
Would it be possible to get around this issue in the mean time with the python "requests" header? And if so, how would I go about adding that to the scripting capabilities? I know this is a little after the post has slowed down, please forgive me. ---
**Author:** ![Phillip\_Jackson](https://avatars.discourse-cdn.com/v4/letter/p/f04885/32.png) [@Phillip\_Jackson](https://forum.inductiveautomation.com/u/Phillip_Jackson)\ **Post date:** [March 3, 2025, 4:40pm UTC](https://forum.inductiveautomation.com/t/how-to-use-digest-authentication-in-httpbinding/83786/13 "2025-03-03T16:40:39Z")
I can't take full credit for this, except for mostly the determination part... between myself and some AI assistance for library syntax (I didn't have any history with the hashlib or constructing digest headers) I put together this headers handshake for digestive using the httpClient and some integrated libraries. The example below is for an Axis camera, but I expect the concept would work for other digest situations. I was able to resolve the resulting data from the function into a perspective image control, so it seems functional. Don't forget to change the username and password. ```python import base64 import json import re import hashlib import random #constants vapixClient = system.net.httpClient() #API Http Client resolution = '1280x720' uriRoot = 'http://' uriImageJpg = '/axis-cgi/jpg/image.cgi?resolution=' username = "#####" password = "#####" def GetSnapshotFromCamera(IPAddress): uri = uriRoot + IPAddress + uriImageJpg + resolution #Send unauthenticated request response = vapixClient.get(uri, timeout=20000) if response: status = response.getStatusCode() auth_header = str(response.getHeaders().get("WWW-Authenticate")) if "Digest" in auth_header: #Parse required values from the auth challenge realm = re.search(r'realm="([^"]+)"', auth_header).group(1) nonce = re.search(r'nonce="([^"]+)"', auth_header).group(1) qop = re.search(r'qop="([^"]+)"', auth_header) qop = qop.group(1) if qop else "auth" #Create HA1, HA2, and response hash ha1 = hashlib.md5("{}:{}:{}".format(username, realm, password)).hexdigest() ha2 = hashlib.md5("GET:{}".format(uri)).hexdigest() nc = "00000001" # Nonce count cnonce = str(random.randint(0, 99999999)) # Client nonce response_hash = hashlib.md5("{}:{}:{}:{}:{}:{}".format(ha1, nonce, nc, cnonce, qop, ha2)).hexdigest() #Construct Digest Authorization header auth_header_value = ( 'Digest username="{}", realm="{}", nonce="{}", uri="{}", ' 'algorithm=MD5, response="{}", qop={}, nc={}, cnonce="{}"' ).format(username, realm, nonce, uri, response_hash, qop, nc, cnonce) #Send the authenticated request headers = {"Authorization": auth_header_value} response = vapixClient.get(uri, headers=headers) status = response.getStatusCode() if status == 200: data = response.getBody() en64 = "data:image/jpg;base64,"+base64.b64encode(data) return en64 ```