Updated 2020-03-01

Authentication and authorization for JSON-RPC

Authentication identifies a user, and authorization verifies user access to requested JSON-RPC methods. Hyperledger Besu verifies users using a JWT token.JWT tokens are also used in multi-tenancy to verify tenant data access.

Besu supports two mutually exclusive authentication methods:

Besu creates JWT tokens internally with username and password authentication, and externally with JWT public key authentication.


To prevent interception of authentication credentials and authenticated tokens, make authenticated requests over HTTPS. We recommended production deployments run behind a network layer that provides SSL termination. Besu does not provide a HTTPS connection natively.

Username and password authentication

Enable authentication from the command line. Supply the credentials file and send a request to the /login endpoint using the username and password. The /login endpoint creates a JWT token for making permitted JSON RPC requests.

Using public key authentication disables the /login endpoint.

1. Create the credentials file

The toml credentials file defines user details and the JSON-RPC methods they can access.

Sample Credentials File

password = "$2a$10$l3GA7K8g6rJ/Yv.YFSygCuI9byngpEzxgWS9qEg5emYDZomQW7fGC"

password = "$2b$10$6sHt1J0MVUGIoNKvJiK33uaZzUwNmMmJlaVLkIwinkPiS1UBnAnF2"

Each user requiring JSON-RPC access the configuration file lists the:

  • Username. Users. is mandatory and followed by the username. That is, replace <username> in [Users.<username>] with the username.
  • Hash of the user password. Use the password hash subcommand to generate the hash.
  • JSON-RPC permissions.
  • Optional. The tenant’s Orion public key using privacyPublicKey. Only used for multi-tenancy.

password hash Subcommand

besu password hash --password=pegasys

2. Enable authentication

To require authentication for the JSON-RPC API, use the --rpc-http-authentication-enabled or --rpc-ws-authentication-enabled options.

To specify the credentials file, use the --rpc-http-authentication-credentials-file and --rpc-ws-authentication-credentials-file options.

3. Generate an authentication token

To generate an authentication token, make a request to the /login endpoint with your username and password. Specify the HTTP port or the WS port to generate a token to authenticate over HTTP or WS respectively. HTTP and WS requires a different token.


curl -X POST --data '{"username":"username1","password":"pegasys"}' <JSON-RPC-http-hostname:http-port>/login
curl -X POST --data '{"username":"username1","password":"pegasys"}' http://localhost:8545/login
curl -X POST --data '{"username":"username1","password":"pegasys"}' <JSON-RPC-ws-hostname:ws-port>/login
curl -X POST --data '{"username":"username1","password":"pegasys"}' http://localhost:8546/login

Authentication tokens expire five minutes after generation. If you require access after the token expires, you need to generate a new token.

JWT public key authentication

Enable authentication from the command line and supply the public key of the external JWT token.

JWT public authentication disables the Besu /login endpoint, meaning username and password authentication will not work.

1. generate a private and public key pair

The private and accompanying public key files must be in .pem format.

The key must use an RSA private key of at least 2048 bits.

Sample using OpenSSL

openssl genrsa -out privateKey.pem 2048
openssl rsa -pubout -in privateKey.pem -pubout -out publicKey.pem

2. create the JWT token

Create the JWT token using an external tool.


The JWT token must use the RS256 algorithm

Each payload for the JWT token contains:

The following example uses the JWT.io website to create a JWT token for testing purposes.

Create a JWT token

3. Enable authentication

To require authentication for the JSON-RPC API, use the --rpc-http-authentication-enabled or --rpc-ws-authentication-enabled options.

To specify the public key to use with the externally created JWT token, use the --rpc-http-authentication-jwt-public-key-file and --rpc-ws-authentication-jwt-public-key-file options.

JSON-RPC permissions

Each user has a list of permissions strings defining the methods they can access. To give access to:

  • All API methods, specify ["*:*"].
  • All API methods in an API group, specify ["<api_group>:*"]. For example, ["eth:*"].
  • Specific API methods, specify ["<api_group>:<method_name>"]. For example, ["admin:peers"].

With authentication enabled, to explicitly specify a user cannot access any methods, include the user with an empty permissions list ([]). Users with an empty permissions list and users not included in the credentials file cannot access any JSON-RPC methods.

Using an authentication token to make requests

Specify the authentication token as a Bearer token in the JSON-RPC request header.


In the Authorization tab in the TYPE drop-down list, select Bearer Token and specify the token (generated either externally or by the login request).


Specify the Bearer in the header.


curl -X POST -H 'Authorization: Bearer <JWT_TOKEN>' -d '{"jsonrpc":"2.0","method":"<API_METHOD>","params":[],"id":1}' <JSON-RPC-http-hostname:port>
curl -X POST -H 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJwZXJtaXNzaW9ucyI6WyIqOioiXSwidXNlcm5hbWUiOiJ1c2VyMiIsImlhdCI6MTU1MDQ2MTQxNiwiZXhwIjoxNTUwNDYxNzE2fQ.WQ1mqpqzRLHaoL8gOSEZPvnRs_qf6j__7A3Sg8vf9RKvWdNTww_vRJF1gjcVy-FFh96AchVnQyXVx0aNUz9O0txt8VN3jqABVWbGMfSk2T_CFdSw5aDjuriCsves9BQpP70Vhj-tseaudg-XU5hCokX0tChbAqd9fB2138zYm5M' -d '{"jsonrpc":"2.0","method":"net_listening","params":[],"id":1}' http://localhost:8545