# Way to make salted api call within a package?
**URL:** https://discourse.julialang.org/t/way-to-make-salted-api-call-within-a-package/9928
**Category:** General Usage
**Tags:** question
**Created:** [March 23, 2018, 6:05pm UTC](https://discourse.julialang.org/t/way-to-make-salted-api-call-within-a-package/9928 "2018-03-23T18:05:34Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@djsegal](https://discourse.julialang.org/u/djsegal)
#### Post date: [March 23, 2018, 6:05pm UTC](https://discourse.julialang.org/t/way-to-make-salted-api-call-within-a-package/9928/1 "2018-03-23T18:05:34Z")
Two use cases:
* * *
1.
Let’s say you wanted to record troubleshooting information from inside your package. However, you don’t want endusers _(at the applications\* level)_ to have access to your api for sending the diagnostic info.
Is there a way to send an api request that’s salted in a way that the user can’t feasibly break it?
\*_using the nomenclature of: [Distinguishing projects from packages](https://discourse.julialang.org/t/distinguishing-projects-from-packages/153)_
* * *
1.
Let’s say you have some jupyter-based web form that boils down someone’s preferences to a single api request that stores the associated information in some company-owned SQL database.
Again, “Is there a way to send an api request that’s salted in a way that the user can’t feasibly break it?”
* * *
The setups are completely hypothetical. They are assumed to be unhackable and take some finite amount of time to complete by a user.
The main question is:
- Is there a way to send an api request that’s doesn’t allow a user to modify it (and **still** have it work)?
---
### Author:  [@StefanKarpinski](https://discourse.julialang.org/u/StefanKarpinski)
#### Post date: [March 23, 2018, 7:33pm UTC](https://discourse.julialang.org/t/way-to-make-salted-api-call-within-a-package/9928/2 "2018-03-23T19:33:46Z")
> [@djsegal](#):
>
> \*using the nomenclature of: Distinguishing projects from packages
I’m not sure if it agrees or disagrees with your usage, but I’ve posted an update on the nomenclature that we’ve settled on in Pkg3:
> [@Distinguishing projects from packages](https://discourse.julialang.org/t/distinguishing-projects-from-packages/153/41):
>
> Update – terminology I ended up using in the Pkg3 documentation: [https://julialang.org/Pkg3.jl/latest/index.html#Glossary-1](https://julialang.org/Pkg3.jl/latest/index.html#Glossary-1) Quoting the relevant parts: Project: a source tree with a standard layout, including a src directory for the main body of Julia code, a test directory for testing the project, docs for documentation files, and optionally a build directory for a build script and its outputs. A project will typically also have a project file and may optionally have a manifest file: Pac…
---
### Author:  [@mbauman](https://discourse.julialang.org/u/mbauman)
#### Post date: [March 23, 2018, 8:54pm UTC](https://discourse.julialang.org/t/way-to-make-salted-api-call-within-a-package/9928/3 "2018-03-23T20:54:11Z")
I think you need to put constraints on your “unhackable” assumption to get meaningful answers here. Aren’t you asking for protections against “hacking”?
Unless you fully control the system they’re working on, it is possible for the user to break/mimic/forge/duplicate any API requests you make on their behalf. You can only obfuscate things to make it harder. The question then is where the bounds are on what is hard enough to be considered “hacking.”
The typical solution to this problem (e.g., in online games) is to make the clients dumb. It’s the server that keeps track of how much money your character has, because otherwise I could just tell the server myself that I have a million gold pieces.
---
### Author:  [@djsegal](https://discourse.julialang.org/u/djsegal)
#### Post date: [March 23, 2018, 9:38pm UTC](https://discourse.julialang.org/t/way-to-make-salted-api-call-within-a-package/9928/4 "2018-03-23T21:38:17Z")
You have a million gold pieces‽
* * *
relevant post:
>
---
### Author:  [@y4lu](https://discourse.julialang.org/u/y4lu)
#### Post date: [March 24, 2018, 1:58am UTC](https://discourse.julialang.org/t/way-to-make-salted-api-call-within-a-package/9928/5 "2018-03-24T01:58:31Z")
Would it be more like #1 storing a fixed hash and only allowing the TS code to run with the matching password passed as an arg, or #2 trying to stash some hidden functions in a module in the package, which would probably always be accessible but obfuscated / not advertised, or more String (/Api?) related