How to secure gRPC using basic authentication?


The Pactus Blockchain offers a gRPC interface, enabling users to interact with both the blockchain and its native wallet. To enhance the security of gRPC APIs, we have implemented a Basic Authentication mechanism. This approach aims to provide a straightforward yet effective means for authenticating clients accessing the APIs.

Note: This mechanism secures gRPC, gRPC gateway, and HTTP communications.

Generate Basic Auth

To enable basic authentication, you need to generate basic authentication credentials using an online tool or a predefined utility.

Example Format:

username: foo
password: bar

result: foo:$2a$10$nl6VKEzSENIK5dmzoADgKeTFtCusQxeVCZiXkRzzbyfG.bLpHtrda

Generate by using htpasswd tool

  1. Install the htpasswd tool from Apache.
  2. Use the htpasswd command-line tool to generate a bcrypt-hashed password. Here’s the general syntax:
htpasswd -bnBC 10 <username> <password>
  • -b: Use the command line to provide the password.
  • -n: Output the hashed password to the console rather than updating a file.
  • -B: Force the use of the bcrypt encryption algorithm.
  • -C cost: Set the cost factor for the bcrypt algorithm. Higher values result in slower hashing but are more secure.
  • username: The username for which you are generating the password.
  • password: The password you wish to hash.


htpasswd -bnBC 10 user pass

This process results in a bcrypt-hashed password that can be used for basic authentication.

Generate With Online tool

To generate basic authentication credentials, you can use the following form to create a hashed credential.

Enable Basic Auth in the Config

  1. Open the config.toml file in your Pactus directory.
  • Windows:C:\Users\{user}\pactus
  • Linux and Mac: /home/{user}/pactus
  1. Insert the generated user with the hashed password into the basic_auth_credential field in the config file.
enable = true
enable_wallet = false
listen = ""
basic_auth_credential = "foo:$2a$10$nl6VKEzSENIK5dmzoADgKeTFtCusQxeVCZiXkRzzbyfG.bLpHtrda"
  1. Restart or run the node to apply this configuration.