# How to mask the sessions of openziti api requests

**URL:** <https://openziti.discourse.group/t/how-to-mask-the-sessions-of-openziti-api-requests/2820>\
**Category:** Uncategorized\
**Created:** [July 5, 2024, 4:44pm UTC](https://openziti.discourse.group/t/how-to-mask-the-sessions-of-openziti-api-requests/2820 "2024-07-05T16:44:16Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sadath-12](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/sadath-12/32/2043_2.png) [@sadath-12](https://openziti.discourse.group/u/sadath-12)\
**Post date:** [July 5, 2024, 4:44pm UTC](https://openziti.discourse.group/t/how-to-mask-the-sessions-of-openziti-api-requests/2820/1 "2024-07-05T16:44:16Z")

</div>

Currently , I'm using password auth , but even if we use cert will still have to pass sessionID at every requests .

We don't want our users to see in network requests and able to access to controller .

Could think of adding firewalls , security rules but we give jwts for user to bring their routers so request can come from anywhere .

So question is how do we mask the information and make it more tight when sending requests .

By answering with the approaches please paste implementation guide link

---

<div class="post-metadata">

**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\
**Post date:** [July 5, 2024, 5:30pm UTC](https://openziti.discourse.group/t/how-to-mask-the-sessions-of-openziti-api-requests/2820/2 "2024-07-05T17:30:59Z")

</div>

Ziti identities may or may not have the administrator privilege. Ziti identities may authenticate with a password or edge enrollment certificate or another identifying document from a trusted provider, e.g. OpenID Connect.

However the identity authenticates, it receives an API session token. It's expected that the identity has access to that token because it represents the identity.