nicolargo/glances · error · HTTPException

Password authentication is not enabled. Start Glances with -

Error message

Password authentication is not enabled. Start Glances with --password option.

What it means

/api/4/token requires the server to run with password mode enabled (self._password set, i.e. glances started with --password). Without it there are no credentials to validate the token request against, so the endpoint returns 501 telling you to restart with --password.

Source

Thrown at glances/outputs/glances_restful_api.py:818

        }

        Returns:
        {
            "access_token": "string",
            "token_type": "bearer",
            "expires_in": int (seconds)
        }
        """
        # Check if JWT is available
        if self._jwt_handler is None or not self._jwt_handler.is_available:
            raise HTTPException(
                status.HTTP_501_NOT_IMPLEMENTED,
                "JWT authentication is not available. Install python-jose or check configuration.",
            )

        # Check if password authentication is enabled
        if self._password is None:
            raise HTTPException(
                status.HTTP_501_NOT_IMPLEMENTED,
                "Password authentication is not enabled. Start Glances with --password option.",
            )

        # Parse request body
        try:
            body = await request.json()
        except Exception:
            raise HTTPException(status.HTTP_400_BAD_REQUEST, "Invalid JSON body")

        username = body.get('username')
        password = body.get('password')

        if not username or not password:
            raise HTTPException(
                status.HTTP_400_BAD_REQUEST,
                "Missing username or password in request body",
            )

View on GitHub (pinned to a240d8dfb3)

Solutions

Restart Glances with --password (glances -w --password) and set the password when prompted.
If you actually want anonymous access, skip the token endpoint entirely — the API is already open.

Example fix

# before
glaces -w
curl -X POST http://localhost:61208/api/4/token
# 501 Password authentication is not enabled

# after
glaces -w --password
curl -X POST http://localhost:61208/api/4/token -d '{"username":"u","password":"p"}'

Defensive patterns

Strategy: validation

Validate before calling

r = requests.get(f'{base}/api/4/config')
if r.status_code == 200:
    pass  # anonymous mode: token endpoint not needed
else:
    # authenticated mode: token flow available

Try / catch

r = requests.post(f'{base}/api/4/token', json=creds)
if r.status_code == 501 and 'password' in r.text:
    # server started without --password; use anonymous access instead

Prevention

Start with --password when token auth is desired.
Don't call /api/4/token against unauthenticated instances.

When it happens

Trigger: Starting glances -w (no --password, anonymous mode) and POSTing to /api/4/token; token-based auth is meaningless because all endpoints are already open.

Common situations: Users experimenting with the token endpoint on default unauthenticated instances; switching a deployment to password mode but forgetting to add the flag.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of nicolargo/glances@a240d8dfb3 (2026-08-27). Data as JSON: /api/errors/3191b0ec39fecc36. Report an issue: GitHub.