UbiFunctions' URLs are publicly exposed. This means that anyone in possession of the URL path would be able to invoke your code.

To add an authentication layer to your function, you may add a preliminary step before execution in order to check the token inside the request.

Ubidots will automatically pass the content of the X-Auth-Token header as an argument of the function:

Request Header

Key inside Function



See a Python example below:

import requests as rq
import json

Returns True or False based on the validity of the token

def account_auth(token):

    response = {
        200: True,
        403: False

    HOST = ""
    PATH = "/api/v1.6/user_check/"
    PARAMETERS = "?token={}".format(token)
    URL = "{}{}{}".format(HOST, PATH, PARAMETERS)

    r = rq.get(URL)

    code = r.status_code

    return response[code]

def main(args):

    token = args.get("token", None)

    if token is None:
        return {"ERROR": "Missing token"}

    valid = account_auth(token)

    if valid is not True:
        return {"ERROR": "Token not valid"}

Please note that the function would still execute, even if the token is invalid, which would still count towards your usage. We are working on a new method to optionally authenticate a function the same way you'r authenticate any Ubidots API request.

Last updated