Enable Universal Token via REST API

[dbrennand]

Description

Does anyone have an example of using the REST API to enable the Universal Token? I've been trying to do it and the Universal Token seems to be changing between API calls 😕

I've taken a look in the Developer Tools to replicate the calls below using Ansible:

    - name: Create | Get Beszel Hub PocketBase API token
      register: beszel_hub_api_token_resp
      ansible.builtin.uri:
        # https://github.com/vaphes/pocketbase/blob/master/pocketbase/services/admin_service.py#L75
        url: http://localhost:8090/api/collections/_superusers/auth-with-password
        method: POST
        headers:
          Authorization: ""
        body:
          identity: molecule@example.com
          password: molecule
        body_format: json

    - name: Create | Get Beszel Universal Token
      register: beszel_universal_token_resp
      ansible.builtin.uri:
        url: http://localhost:8090/api/beszel/universal-token
        method: GET
        body_format: json
        headers:
          Authorization: "{{ beszel_hub_api_token_resp.json.token }}"
        body:
          enable: -1
          token: ""

    - name: Create | Enable Beszel Universal Token
      ansible.builtin.uri:
        url: http://localhost:8090/api/beszel/universal-token
        method: GET
        body_format: json
        headers:
          Authorization: "{{ beszel_hub_api_token_resp.json.token }}"
        body:
          token: "{{ beszel_universal_token_resp.json.token }}"
          enable: 1

Here is the output from each task:

TASK [Create | Get Beszel Universal Token] *************************************
task path: /Users/dab/repos/community.beszel/extensions/molecule/agent_token/create.yml:22
ok: [localhost] => {"changed": false, "connection": "close", "content_length": "64", "content_type": "application/json", "cookies": {}, "cookies_string": "", "date": "Sun, 05 Oct 2025 11:44:50 GMT", "elapsed": 0, "json": {"active": false, "token": "ca995e6d-a8d1-416f-b77d-ea2d297060ae"}, "msg": "OK (64 bytes)", "redirected": false, "status": 200, "url": "http://localhost:8090/api/beszel/universal-token", "vary": "Origin", "x_content_type_options": "nosniff", "x_frame_options": "SAMEORIGIN", "x_xss_protection": "1; mode=block"}

TASK [Create | Enable Beszel Universal Token] **********************************
task path: /Users/dab/repos/community.beszel/extensions/molecule/agent_token/create.yml:34
ok: [localhost] => {"changed": false, "connection": "close", "content_length": "64", "content_type": "application/json", "cookies": {}, "cookies_string": "", "date": "Sun, 05 Oct 2025 11:44:50 GMT", "elapsed": 0, "json": {"active": false, "token": "91511255-0787-427e-bb3d-67141f240323"}, "msg": "OK (64 bytes)", "redirected": false, "status": 200, "url": "http://localhost:8090/api/beszel/universal-token", "vary": "Origin", "x_content_type_options": "nosniff", "x_frame_options": "SAMEORIGIN", "x_xss_protection": "1; mode=block"}

In the first call to get the current token, it's ca995e6d-a8d1-416f-b77d-ea2d297060ae but then when I send the REST call to enable, it succeeds but the token changes to 91511255-0787-427e-bb3d-67141f240323 🤔

CC @chrisdeeming

OS / Architecture

linux/amd64

Beszel version

0.13.0

Installation method

Docker

Configuration

---
services:
  beszel:
    image: ghcr.io/henrygd/beszel/beszel:0.13.0
    container_name: beszel
    restart: unless-stopped
    environment:
      - USER_EMAIL=molecule@example.com
      - USER_PASSWORD=molecule
    networks:
      - beszel
    ports:
      - 8090:8090
    volumes:
      - beszel_data:/beszel_data

volumes:
  beszel_data:

networks:
  beszel:

Hub Logs

2025/10/05 11:44:48 Server started at http://0.0.0.0:8090
├─ REST API:  http://0.0.0.0:8090/api/
└─ Dashboard: http://0.0.0.0:8090/_/

Agent Logs

No response

[henrygd]

Try using URL query params instead of request body. Otherwise I think this should work fine. Let me know if not.

url: http://localhost:8090/api/beszel/universal-token?enable=1

[dbrennand]

Yes, I'm logging in with the same user molecule@example.com after I made the REST API calls.

[henrygd]

Weird! I'll test with https://github.com/ansible-collections/community.beszel/tree/0.3.1 when I can. May be a few days until I can get to it.

[jstet]

First, thanks for developing this app. I have the same problem and wanted to ask if you already had a chance to look at this (Beszel 0.15.2).

[henrygd]

I did try using this Bun / TS script and it seems to work as intended. I haven't had time to try out the Ansible setup.

import { env } from "bun";

const server = env.SERVER ?? "http://localhost:8090";
const userEmail = env.EMAIL ?? "user@example.com";
const userPassword = env.PASSWORD ?? "password";
const authToken = env.AUTH_TOKEN ?? await getHubAuthToken(userEmail, userPassword);

// may or may not be enabled
await getUniversalToken(authToken).then(console.log);

// make sure it's enabled
await enableUniversalToken(authToken).then(console.log);

// should be enabled now
await getUniversalToken(authToken).then(console.log);

// get user auth token
async function getHubAuthToken(userEmail: string, userPassword: string) {
   const response = await fetch(`${server}/api/collections/users/auth-with-password`, {
      method: "POST",
      headers: {
         "Content-Type": "application/json",
      },
      body: JSON.stringify({
         identity: userEmail,
         password: userPassword,
      }),
   });
   const { token } = (await response.json()) as { token: string };
   return token;
}

// get universal token
async function getUniversalToken(authToken: string) {
   const tokenResponse = await fetch(`${server}/api/beszel/universal-token`, {
      method: "GET",
      headers: {
         Authorization: authToken,
      },
   });
   return (await tokenResponse.json()) as { token: string, active: boolean };
}

// enable universal token
async function enableUniversalToken(authToken: string) {
   const tokenResponse = await fetch(`${server}/api/beszel/universal-token?enable=1`, {
      method: "GET",
      headers: {
         Authorization: authToken,
      },
   });
   return (await tokenResponse.json()) as { token: string, active: boolean };
}

[jstet]

I've been using this script:

#!/bin/bash

POCKETBASE_URL="http://127.0.0.1:8090"
ADMIN_EMAIL="{{ pocketbase_admin_email }}"
ADMIN_PASSWORD="{{ pocketbase_admin_password }}"

AUTH_RESPONSE=$(curl -s -X POST "${POCKETBASE_URL}/api/collections/_superusers/auth-with-password" -H "Content-Type: application/json" -d '{"identity":"'"${ADMIN_EMAIL}"'","password":"'"${ADMIN_PASSWORD}"'"}')
AUTH_TOKEN=$(echo "$AUTH_RESPONSE" | jq -r '.token')


if [ -z "$AUTH_TOKEN" ] || [ "$AUTH_TOKEN" = "null" ]; then
  echo "Error: Failed to authenticate" >&2
  echo "Email: $ADMIN_EMAIL" >&2
  echo "Response: $AUTH_RESPONSE" >&2
  exit 1
fi

GETKEY_RESPONSE=$(curl -s "${POCKETBASE_URL}/api/beszel/getkey" -H "Authorization: $AUTH_TOKEN")
PUB_KEY=$(echo "$GETKEY_RESPONSE" | jq -r '.key // empty' 2>/dev/null)

if [ -z "$PUB_KEY" ] || [ "$PUB_KEY" = "null" ]; then
  echo "Error: Failed to get public key from /getkey endpoint" >&2
  echo "Response: $GETKEY_RESPONSE" >&2
  exit 1
fi


echo "$PUB_KEY"

But when I used the same auth endpoint you used, it worked. Thanks for testing and helping me solve this problem!

[henrygd]

No problem!

@dbrennand Let me know if that script helps at all. I cloned the Ansible repo but I'm not exactly sure what I'm doing. Do I just run uv run molecule test -s agent_token? Don't have a lot of xp with Python or Ansible.

[dbrennand]

Hey @henrygd - There is a https://github.com/ansible-collections/community.beszel/blob/main/CONTRIBUTING.md file in the repository which has the details for getting the development environment set up. 🙂

Specifically the first section for set up and the Running Molecule tests section.

I'm just taking a look at this now. Will report back from my testing 🙂

[dbrennand]

Hi @henrygd @jstet

Can confirm from my testing too that enabling the Universal Token works but you have to authenticate and get a token using the users/auth-with-password endpoint and not superusers/auth-with-password.

Should it work with both @henrygd? Is this a bug?

[dbrennand]

FYI - The community.beszel Ansible collection now has a universal_token module as of release 0.6.0 for enabling and disabling the universal token 🙂

[henrygd]

Nice!