Add users to Netlify Identity with Postman
Tags: jamstack, tips, webdev, netlify
Published: 2020-12-07 17:54:38

---
title: "Add users to Netlify Identity with Postman"
description:  "Identity HTTP API endpoints are open to the internet"
published: true
date: 2020-12-07 08:00:00 UTC
tags: jamstack,tips,webdev,netlify
series: "Holiday letter authentication"
canonical_url: https://katiekodes.com/netlify-identity-api-add-user/
---

I've been playing w/ Netlify Identity and just discovered that Postman-friendly HTTPS API endpoints for managing Netlify Identity are wide open to the whole internet _(which kind of makes sense, since they expose the sorts of actions you'd normally expose with signup forms)_.  However, they're not clearly documented.

I'm trying to seed my holiday letter website with a bunch of family members' e-mail addresses.  I don't want them to receive signup confirmation e-mails -- I just want them to be "users" of my system.

I'd been thinking about using a single simple password to protect the whole site.  Netlify charges money for that, but they don't charge me anything to set up 100 users and give them all the same password.

Plus, now someone has to know both the e-mail address of one of my family members _and_ the common password _(well, or just have control of their email, I suppose ... they could reset the password)_ to get into my site.

I was also considering Auth0's "magic link" passwordless authentication, so that's essentially the same level of security I was looking at in the first place.

_(Netlify doesn't currently offer passwordless authentication.)_

Surfing ["endpoints" in Netlify's GoTrue library](https://github.com/netlify/gotrue#endpoints) that powers Identity, I couldn't figure out how to authenticate to the API for managing users.

Turns out there _isn't_ any authentication -- the endpoints are open to the whole internet.

I figured this out when I gave up and simply tried performing an HTTP `POST` operation in Postman against `https://my-site.netlify.app/.netlify/identity/signup` with a `Content-Type` header of `application/json` and a body of `{"email": "example@mydomain.com","password": "correcthorse"}`.

At first, I received an HTTP response with the `Forbidden` status code `403`, and a response body of `{"code":403,"msg":"Signups not allowed for this instance"}`.

I flipped Registration back from "Invite-only" to "Open" at `https://app.netlify.com/sites/my-site/settings/identity` and tried again.

This time, I received an HTTP response with the `OK` status code `200`, and a response body of:

```json
{
 "id": "987654321",
 "aud": "",
 "role": "",
 "email": "example@mydomain.com",
 "confirmed_at": "2020-12-07T17:14:01.856778419Z",
 "app_metadata": {
  "provider": "email"
 },
 "user_metadata": null,
 "created_at": "2020-12-07T17:14:01.851876Z",
 "updated_at": "2020-12-07T17:14:01.856903Z"
}
```

Visiting `https://app.netlify.com/sites/my-site/identity`, I saw `example@mydomain.com` in the list of users.

Checking my e-mail, I had not received an email from Netlify.

**Perfect**.

I flipped Registration back from "Open" to "Invite-only" before anyone else on the internet got up to any mischief.

It'd be nice if Netlify Identity had some sort of admin-protected way of creating users with prepopulated passwords while registration is "invite-only," but oh well.  This will do.