I want to enable API calls to my full node from an host besides localhost. The question is what startup flags or equivalent entries in an *.ini config file* do I need to make authenticated API calls?

From my experience these configurations are required:

```
API_HOST = 0.0.0.0
IRI_OPTIONS = "--remote"
REMOTE_AUTH = user:pw

```

(*user* is a username and *pw* a password.)

With this setup I need to provide a flag *--user usr:pw* if I use curl. Example call:

```
curl --user usr:pw http://public-fullnodenode-ip:port -X POST -H 'Content-Type: application/json' -H 'X-IOTA-API-Version: 1' -d '{"command": "getNeighbors"}'

```

The auth info *--user usr:pw* matches with the entry in my full node config .ini *REMOTE\_AUTH = user:pw*.

This works but is probably not the correct way. Because following the startup flag [documentation](https://iotasupport.com/startup-flags.shtml) it should be a ***username:hashedpassword*** combination. Not a *username:password* combination:

> 
> --remote-auth
> 
> 
> Require authentication password for accessing remotely. Requires a correct username:hashedpassword combination. Example input:
> --remote-auth iotatoken:LL9EZFNCHZCMLJLVUBCKJSWKFEXNYRHHMYS9XQLUZRDEKUUDOCMBMRBWJEMEDDXSDPHIGQULENCRVEYMO
> 
> 
> 

So how is it done the correct way?

What hash algorithm should be used? And in the curl call behind *--user* is still a password (not the hash) provided?

The API call with curl is not transport encrypted right? Is it insecure to use the *--user* flag?