# Auth-token and updating schema - "Alter denied with error: No Auth Token found"

**URL:** <https://discuss.dgraph.io/t/auth-token-and-updating-schema-alter-denied-with-error-no-auth-token-found/9380>\
**Category:** Dgraph Clients\
**Created:** [August 12, 2020, 9:41am UTC](https://discuss.dgraph.io/t/auth-token-and-updating-schema-alter-denied-with-error-no-auth-token-found/9380 "2020-08-12T09:41:05Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![erlendoverby](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/erlendoverby/32/988_2.png) [@erlendoverby](https://discuss.dgraph.io/u/erlendoverby)\
**Post date:** [August 12, 2020, 9:41am UTC](https://discuss.dgraph.io/t/auth-token-and-updating-schema-alter-denied-with-error-no-auth-token-found/9380/1 "2020-08-12T09:41:05Z")

</div>

I’m using:

Dgraph version : v20.07.0  
Dgraph codename : shuri  
Dgraph SHA-256 : 4cd320fc6eab163ab68602a5122a6c82c8467c2ed5ac93478d5f40d44eec71c4  
Commit SHA-1 : d65e20530  
Commit timestamp : 2020-07-28 15:31:37 -0700  
Branch : HEAD  
Go version : go1.14.4

To increase the security of my services a little I have added a auth\_token to my startup of dgraph alpha.  
In my dgraph-js client I have added the auth-token secret to the dGraph client.  
The client is whitelisted.

let dgraphStub = dgraph.DgraphClientStub(DGRAPH\_SERVER\_URL, grpc.credentials.createInsecure(),  
{  
‘auth-token’: ‘secret’  
})

let dGraphClient = dgraph.DgraphClient(dgraphStub)

This works great when I mutate and read data from the database.

However, when I try to update my schema -

let dGraphOperation = new dgraph.Operation()  
dGraphOperation(’’)  
dgraphClient.alter(dGraphOperation)

I get the following error:  
“server.go:222] Alter denied with error: No Auth Token found. Token needed for Alter operations.”

And in my understanding I have submitted the Token needed.  
In the dgraph4j client there is an example on how to set up the auth-token to make it work.

Is there an example on how this could be implemented using the dgraph-js client?

Best regards  
Erlend Øverby

---

<div class="post-metadata">

**Author:** ![MichelDiz](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/micheldiz/32/11873_2.png) [@MichelDiz](https://discuss.dgraph.io/u/MichelDiz)\
**Post date:** [August 13, 2020, 2:12am UTC](https://discuss.dgraph.io/t/auth-token-and-updating-schema-alter-denied-with-error-no-auth-token-found/9380/2 "2020-08-13T02:12:41Z")

</div>

`--auth_token` - This token, for now, protects only the Alter and Admin requests. Not mutations or queries. The Poor man’s ACL will be soon available for other requests.

See this [comment](http://discuss.hypermode.com/t/we-have-a-foe-among-friends/7634/14).

> [@erlendoverby](#):
>
> Is there an example on how this could be implemented using the dgraph-js client?

So, for the Alter case, I’m not sure if it is implemented in Dgraph-js. Maybe @paulftw or @dmai can give some light here.

---

<div class="post-metadata">

**Author:** ![MichelDiz](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/micheldiz/32/11873_2.png) [@MichelDiz](https://discuss.dgraph.io/u/MichelDiz)\
**Post date:** [August 13, 2020, 3:11am UTC](https://discuss.dgraph.io/t/auth-token-and-updating-schema-alter-denied-with-error-no-auth-token-found/9380/3 "2020-08-13T03:11:21Z")

</div>

Actually I have found the solution. It is pretty easy. You have to use grpc’s method to create the metadata. And use it on each call. e.g:

This is very similar to [GitHub - dgraph-io/dgo: Official Dgraph Go client](https://github.com/dgraph-io/dgo#setting-metadata-headers)

Set this “globally”.

```auto
var meta = new grpc.Metadata();
meta.add('auth-token', 'myTestSecret');

```

And on each call add the meta var

```auto
async function dropAll(dgraphClient) {
    const op = new dgraph.Operation();
    op.setDropAll(true);
    await dgraphClient.alter(op, meta);
}

async function setSchema(dgraphClient) {
    const schema = `
        name: string @index(exact) .
        age: int .
        married: bool .
        loc: geo .
        dob: datetime .
        friend: [uid] @reverse .
    `;
    const op = new dgraph.Operation();
    op.setSchema(schema);
    await dgraphClient.alter(op, meta);
}

```

---

<div class="post-metadata">

**Author:** ![erlendoverby](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/erlendoverby/32/988_2.png) [@erlendoverby](https://discuss.dgraph.io/u/erlendoverby)\
**Post date:** [August 13, 2020, 11:00pm UTC](https://discuss.dgraph.io/t/auth-token-and-updating-schema-alter-denied-with-error-no-auth-token-found/9380/4 "2020-08-13T23:00:25Z")

</div>

Thanks - this solved my problem. You are wizards 🙂

However it does not work if the token contains the letter &.

And it is my misinterpretation that the auth\_token also was checking mutation operations.

Keep up the great work

Cheers  
Erlend

---

<div class="post-metadata">

**Author:** ![Naman](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/naman/32/3498_2.png) [@Naman](https://discuss.dgraph.io/u/Naman)\
**Post date:** [August 24, 2020, 1:39pm UTC](https://discuss.dgraph.io/t/auth-token-and-updating-schema-alter-denied-with-error-no-auth-token-found/9380/5 "2020-08-24T13:39:46Z")

</div>

@erlendoverby, closing this issue. As the problem is solved, can you please mark the answer as solution. 🙂

---

<div class="post-metadata">

**Author:** ![Naman](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/naman/32/3498_2.png) [@Naman](https://discuss.dgraph.io/u/Naman)\
**Post date:** [August 24, 2020, 1:39pm UTC](https://discuss.dgraph.io/t/auth-token-and-updating-schema-alter-denied-with-error-no-auth-token-found/9380/6 "2020-08-24T13:39:49Z")

</div>