# FOREST\_AUTH\_SECRET how to set / choose

**URL:** <https://community.forestadmin.com/t/forest-auth-secret-how-to-set-choose/593>\
**Category:** Help me!\
**Created:** [July 3, 2020, 1:02am UTC](https://community.forestadmin.com/t/forest-auth-secret-how-to-set-choose/593 "2020-07-03T01:02:58Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![jesse-elve](https://avatars.discourse-cdn.com/v4/letter/j/258eb7/32.png) [@jesse-elve](https://community.forestadmin.com/u/jesse-elve)\
**Post date:** [July 3, 2020, 1:02am UTC](https://community.forestadmin.com/t/forest-auth-secret-how-to-set-choose/593/1 "2020-07-03T01:02:58Z")

</div>

## Expected behavior

I would expect to find documentation explaining how the FOREST\_AUTH\_SECRET is “chosen”. Also, how to obtain the value of this secret for a dev environment.

## Actual behavior

I find the definition of FOREST\_AUTH\_SECRET in the glossary: " A **private** token - chosen by yourself - used to sign the data token." I do not find how to choose this token after searching the documentation. My local docker container has this environment variable set.

Creating a new environment only shows the “FOREST\_ENV\_SECRET” but not a FOREST \_AUTH\_SECRET". You can’t seem to copy the auth secret from any other environment for the same project because it is different in each case. Base on this, I can’t figure out how to create a new dev environment since setting only the FOREST\_ENV\_SECRET causes the environment to fail to start.

---

<div class="post-metadata">

**Author:** ![anon79585656](https://avatars.discourse-cdn.com/v4/letter/a/7ab992/32.png) [@anon79585656](https://community.forestadmin.com/u/anon79585656)\
**Post date:** [July 3, 2020, 1:43pm UTC](https://community.forestadmin.com/t/forest-auth-secret-how-to-set-choose/593/2 "2020-07-03T13:43:18Z")

</div>

Hello @jesse-elve,

Thank you for sharing your issue.

An initial value for the `FOREST_AUTH_SECRET` token should be generated and included in the wizard commands that you need to copy/paste on your end.

For new environments, you can set `FOREST_AUTH_SECRET` to a random value in you configuration file.

---

<div class="post-metadata">

**Author:** ![julongbh](https://avatars.discourse-cdn.com/v4/letter/j/7cd45c/32.png) [@julongbh](https://community.forestadmin.com/u/julongbh)\
**Post date:** [August 18, 2020, 9:33am UTC](https://community.forestadmin.com/t/forest-auth-secret-how-to-set-choose/593/3 "2020-08-18T09:33:34Z")

</div>

Hi,

I came across the same problem (401 unauthorized + IP whitelist error + Unlock your data form) and tried to follow the solution above by setting FOREST\_AUTH\_SECRET to a random string as an environment variable in my forest admin backend container for test environments. As stated above there isn’t any problem with forest admin provided FOREST\_AUTH\_SECRET strings for production/staging. I’m creating environments through the forest-cli to get the ENV\_SECRET and just set a random 32 alphanumeric character strings to FOREST\_AUTH\_SECRET, is there a step I’m forgetting?

it calls /session but there isn’t any forest session token in the request, it does appear for the production environment though.

Thanks a lot

---

<div class="post-metadata">

**Author:** ![Arnaud\_Moncel](https://dub1.discourse-cdn.com/flex013/user_avatar/community.forestadmin.com/arnaud_moncel/32/24_2.png) [@Arnaud\_Moncel](https://community.forestadmin.com/u/Arnaud_Moncel)\
**Post date:** [August 18, 2020, 12:08pm UTC](https://community.forestadmin.com/t/forest-auth-secret-how-to-set-choose/593/4 "2020-08-18T12:08:31Z")

</div>

Hi @julongbh and welcome to our community.  
To clarify your problem and the context can you answer these few questions please?

The error occurred on a `development` environment?  
Have you got any errors on your server start?

---

<div class="post-metadata">

**Author:** ![julongbh](https://avatars.discourse-cdn.com/v4/letter/j/7cd45c/32.png) [@julongbh](https://community.forestadmin.com/u/julongbh)\
**Post date:** [August 18, 2020, 12:25pm UTC](https://community.forestadmin.com/t/forest-auth-secret-how-to-set-choose/593/5 "2020-08-18T12:25:52Z")

</div>

Hi @Arnaud_Moncel,

thank you for your answer,  
yes it is a development environment, created through

```javascript
forest environments:create -p=$FOREST_APPLICATION_ID -n=$ENV_NAME -u=https://$CI_COMMIT_REF_SLUG.admin.$BASE_DOMAIN --format=json

```

and I got this in my server log after trying a login

```javascript
Your application is listening on port 80.
Your admin panel is available here: https://app.forestadmin.com/projects
GET / 200 10026 - 7.324 ms
GET / 200 10026 - 2.166 ms
GET / 200 10026 - 1.156 ms
GET / 200 10026 - 1.219 ms
GET / 200 10026 - 1.058 ms
GET / 200 10026 - 0.832 ms
GET / 200 10026 - 0.617 ms
GET / 200 10026 - 0.898 ms
GET / 200 10026 - 0.610 ms
GET / 200 10026 - 0.624 ms
GET / 200 10026 - 0.922 ms
GET / 200 10026 - 0.805 ms

```

---

<div class="post-metadata">

**Author:** ![Arnaud\_Moncel](https://dub1.discourse-cdn.com/flex013/user_avatar/community.forestadmin.com/arnaud_moncel/32/24_2.png) [@Arnaud\_Moncel](https://community.forestadmin.com/u/Arnaud_Moncel)\
**Post date:** [August 18, 2020, 1:28pm UTC](https://community.forestadmin.com/t/forest-auth-secret-how-to-set-choose/593/6 "2020-08-18T13:28:54Z")

</div>

You say, the `/session` route is called.  
What is the result of this one ? Have you got a `jwt token` well formatted?  
Have you got any error logs before / after this call on your server?

---

<div class="post-metadata">

**Author:** ![julongbh](https://avatars.discourse-cdn.com/v4/letter/j/7cd45c/32.png) [@julongbh](https://community.forestadmin.com/u/julongbh)\
**Post date:** [August 18, 2020, 1:37pm UTC](https://community.forestadmin.com/t/forest-auth-secret-how-to-set-choose/593/7 "2020-08-18T13:37:45Z")

</div>

yes, the /session route is called and I got this in the inspector, no sign of token in there, and no error whatsoever in the logs of the forest admin backend

```javascript
Response=
access-control-allow-credentials: true
access-control-allow-origin: https://app.forestadmin.com
content-length: 44
content-type: application/json; charset=utf-8
date: Tue, 18 Aug 2020 13:30:41 GMT
etag: W/"2c-F72gDdrlXS72IK0z3eSuP4xgxHw"
server: nginx/1.19.1
status: 401
strict-transport-security: max-age=15724800; includeSubDomains
vary: Origin
x-powered-by: Express

Request=
:authority: [SERVER_URL]
:method: POST
:path: /forest/sessions
:scheme: https
accept: application/json, text/javascript, */*; q=0.01
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9,fr;q=0.8,ko;q=0.7
content-length: 151
content-type: application/json; charset=UTF-8
dnt: 1
origin: https://app.forestadmin.com
referer: https://app.forestadmin.com/location-admin/review-backend-fix-deploy-forest/Operations/data/pet/index
sec-fetch-dest: empty
sec-fetch-mode: cors
sec-fetch-site: cross-site
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36

request payload=
email: [MY_EMAIL]
password: [MY_PASSWORD]
projectId: "48974"
renderingId: "69981"
token: null
twoFactorRegistration: false

```

and I got this in the ENV vars

```javascript
      APPLICATION_PORT: 80
      APPLICATION_HOST: [HOST]
      DATABASE_URL: [MYSQL_STRING]
      DATABASE_SSL: false
      APP_NAME: location-admin
      DATABASE_ENCRYPT: false
      FOREST_AUTH_SECRET: [RANDOM_STRING]
      FOREST_ENV_SECRET: [SECRET_FROM_FOREST_CLI]
      NODE_ENV: development

```

Instead for the production one, which is totally similar in term of deployment and config, I got token and everything working.

---

<div class="post-metadata">

**Author:** ![julongbh](https://avatars.discourse-cdn.com/v4/letter/j/7cd45c/32.png) [@julongbh](https://community.forestadmin.com/u/julongbh)\
**Post date:** [August 18, 2020, 1:43pm UTC](https://community.forestadmin.com/t/forest-auth-secret-how-to-set-choose/593/8 "2020-08-18T13:43:46Z")

</div>

I got all the 401 errors appearing in my nginx-ingress logs though, but the production and development forest admin backend deploys got the exact same nginx config in front of it, so it doesn’t look like its a cors or routing config problem.

```javascript
// the environment details
{
  "name": "review-backend-fix-deploy-forest",
  "apiEndpoint": "[ENDPOINT]",
  "secretKey": "[SECRET_KEY]",
  "isActive": true,
  "type": "development",
  "stage": "unknown",
  "lianaName": "forest-express-sequelize",
  "lianaVersion": "6.3.6",
  "twoFactorAuthenticationEnabled": false,
  "version": "1",
  "id": "58997",
  "currentBranch": null
}

```

---

<div class="post-metadata">

**Author:** ![Harry\_Nguyen](https://dub1.discourse-cdn.com/flex013/user_avatar/community.forestadmin.com/harry_nguyen/32/1794_2.png) [@Harry\_Nguyen](https://community.forestadmin.com/u/Harry_Nguyen)\
**Post date:** [March 16, 2021, 7:43am UTC](https://community.forestadmin.com/t/forest-auth-secret-how-to-set-choose/593/9 "2021-03-16T07:43:21Z")

</div>

Hello team,

I lost FOREST\_AUTH\_SECRET on production, can you help to show me how to get it? or help to delete the existing production environment. My environment id 69686

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![anon39848301](https://avatars.discourse-cdn.com/v4/letter/a/b9e5f3/32.png) [@anon39848301](https://community.forestadmin.com/u/anon39848301)\
**Post date:** [March 16, 2021, 8:29am UTC](https://community.forestadmin.com/t/forest-auth-secret-how-to-set-choose/593/10 "2021-03-16T08:29:44Z")

</div>

Hi @Harry_Nguyen, and welcome to our community 👋,

As @anon79585656 stated here, [FOREST\_AUTH\_SECRET how to set / choose - #2 by Guillaume\_Deslandes](https://community.forestadmin.com/t/forest-auth-secret-how-to-set-choose/593/2), `FOREST_AUTH_SECRET` could be randomly chose when creating a new environment.

If you need specific actions to be made (For an environment deletion in your case), I suggest to contact this us via [support@forestadmin.com](mailto:support@forestadmin.com).

Let me know if that helps 🙏