# Problems using Basic authorization with Streams

**URL:** <http://forum.companieshouse.gov.uk/t/problems-using-basic-authorization-with-streams/5384>\
**Category:** Uncategorized\
**Created:** [August 23, 2022, 7:52am UTC](http://forum.companieshouse.gov.uk/t/problems-using-basic-authorization-with-streams/5384 "2022-08-23T07:52:04Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![jonmarkperry](http://forum.companieshouse.gov.uk/user_avatar/forum.companieshouse.gov.uk/jonmarkperry/32/1329_2.png) [@jonmarkperry](http://forum.companieshouse.gov.uk/u/jonmarkperry)\
**Post date:** [August 23, 2022, 7:52am UTC](http://forum.companieshouse.gov.uk/t/problems-using-basic-authorization-with-streams/5384/1 "2022-08-23T07:52:04Z")

</div>

I have created a temporary application to get a streaming key, to access

> [Streaming API: Basic company information stream (company-information.service.gov.uk)](https://developer-specs.company-information.service.gov.uk/streaming-api/reference/company-information/stream)

following the instructions for Streaming given at

> [Streaming API: (company-information.service.gov.uk)](https://developer-specs.company-information.service.gov.uk/streaming-api/guides/authentication)

I have used XHR in Excel and with JavaScript, but I can’t get through.

EXCEL

Sub Button1\_Click()

Dim xmlhttp As Object  
Set xmlhttp = CreateObject(“MSXML2.serverXMLHTTP”)  
Dim myurl As String  
myurl = “[https://stream.companieshouse.gov.uk/companies](https://stream.companieshouse.gov.uk/companies)”  
skey = “f8da6601-6121-49e7-9b1f-8e3d7f726b57”  
key64 = “ZjhkYTY2MDEtNjEyMS00OWU3LTliMWYtOGUzZDdmNzI2YjU3Og==”  
xmlhttp.Open “GET”, myurl, False  
xmlhttp.setRequestHeader “Authorization”, "Basic " & key64  
xmlhttp.Send  
rsp = xmlhttp.responseText  
[a4] = rsp

End Sub

JS

xhr =new XMLHttpRequest();  
url = “[https://stream.companieshouse.gov.uk/companies](https://stream.companieshouse.gov.uk/companies)”;  
skey = “f8da6601-6121-49e7-9b1f-8e3d7f726b57”;  
key64 = “ZjhkYTY2MDEtNjEyMS00OWU3LTliMWYtOGUzZDdmNzI2YjU3Og==”;  
xhr.open(“GET”,url, false);  
xhr.setRequestHeader(“Authorization”, "Basic " + key64);  
xhr.onload=()=\>{  
rsp = xhr.response;  
out.innerHTML = rsp;  
}  
xhr.send();

---

<div class="post-metadata">

**Author:** ![phillip](http://forum.companieshouse.gov.uk/letter_avatar_proxy/v4/letter/p/3e96dc/32.png) [@phillip](http://forum.companieshouse.gov.uk/u/phillip)\
**Post date:** [August 23, 2022, 6:04pm UTC](http://forum.companieshouse.gov.uk/t/problems-using-basic-authorization-with-streams/5384/2 "2022-08-23T18:04:20Z")

</div>

> [@jonmarkperry](#):
>
> url = “ttps://stream.companieshouse.gov.uk/companies”;

Not sure whether you can do this in Excel, nevertheless, Is that a typo there with a missing “h”? url = “[https://stream.companieshouse.gov.uk/companies”](https://stream.companieshouse.gov.uk/companies%E2%80%9D);

---

<div class="post-metadata">

**Author:** ![jonmarkperry](http://forum.companieshouse.gov.uk/user_avatar/forum.companieshouse.gov.uk/jonmarkperry/32/1329_2.png) [@jonmarkperry](http://forum.companieshouse.gov.uk/u/jonmarkperry)\
**Post date:** [August 23, 2022, 6:23pm UTC](http://forum.companieshouse.gov.uk/t/problems-using-basic-authorization-with-streams/5384/3 "2022-08-23T18:23:28Z")

</div>

I’m only allowed 2 links per post (because I’m a newbie here), so I removed the ‘h’ from 'h\*tps to bypass the checker.

---

<div class="post-metadata">

**Author:** ![voracityemail](http://forum.companieshouse.gov.uk/letter_avatar_proxy/v4/letter/v/b77776/32.png) [@voracityemail](http://forum.companieshouse.gov.uk/u/voracityemail)\
**Post date:** [August 23, 2022, 8:29pm UTC](http://forum.companieshouse.gov.uk/t/problems-using-basic-authorization-with-streams/5384/4 "2022-08-23T20:29:49Z")

</div>

Do you get an error? What http response code do you get and what (if any) body do you get?

Just wondering what exactly are you wanting to do here? I don’t use the stream API myself but as I understand (or [as Companies House say in their introduction](https://developer-specs.company-information.service.gov.uk/streaming-api/guides/overview)) you need to:  
a) establish a long-running http connection  
b) stay connected as long as possible: “Conceptually, you can think of this as downloading an infinitely long file over HTTP.”

So the Excel code (VBA?) or javascript would need to be able to:  
a) keep the connection open - so you might need to alter built-in timeouts. If you kept disconnecting and reconnecting Companies House say they may block you.  
b) respond to streamed information as it arrives (before a connection ends - as Companies House aim to avoid ending this). I don’t know about Excel. I’ve not done that with [javascript XMLHttpRequest myself](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/Using_XMLHttpRequest) and I’m not sure that’s possible. However it does look like [streams may be available](https://developer.mozilla.org/en-US/docs/Web/API/ReadableStream) when using [the fetch API](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/Using_Fetch) so this might work for you - again it’s not something I’ve done personally.

There might be 3rd party libraries to help with that also - especially if you were using javascript in a server environment e.g. Node / Deno.

Good luck.

---

<div class="post-metadata">

**Author:** ![jonmarkperry](http://forum.companieshouse.gov.uk/user_avatar/forum.companieshouse.gov.uk/jonmarkperry/32/1329_2.png) [@jonmarkperry](http://forum.companieshouse.gov.uk/u/jonmarkperry)\
**Post date:** [August 24, 2022, 4:53am UTC](http://forum.companieshouse.gov.uk/t/problems-using-basic-authorization-with-streams/5384/5 "2022-08-24T04:53:08Z")

</div>

JS gives a CORS error:

> ```
> Access to XMLHttpRequest at 'https://stream.companieshouse.gov.uk/companies' from origin 'null' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
> 
> ```

Excel says:

> {“error”:“Invalid Authorization”,“type”:“ch:service”}

But I can’t see why a public API would be CORS protected, and Excel seems to say my username (API key) is wrong, but I think I have followed the instructions properly.

---

<div class="post-metadata">

**Author:** ![voracityemail](http://forum.companieshouse.gov.uk/letter_avatar_proxy/v4/letter/v/b77776/32.png) [@voracityemail](http://forum.companieshouse.gov.uk/u/voracityemail)\
**Post date:** [August 24, 2022, 9:23am UTC](http://forum.companieshouse.gov.uk/t/problems-using-basic-authorization-with-streams/5384/6 "2022-08-24T09:23:29Z")

</div>

Update: the “origin null” suggests you’re maybe using localhost (or haven’t registered your js domain with Companies House) so see this thread (or similar ones):

> **[Allow localhost JavaScript domain?](https://forum.aws.chdev.org/t/allow-localhost-javascript-domain/83/12)**
>
> Hello @david, A workaround is simply to give a hostname to your IP address, by editing /etc/hosts or its equivalent on your OS. 192.168.0.1 localhost my.localdomain And you can now register my.localdomain as a CH API “JavaScript domains”. ...

As always I recommend starting from basics. Check your actual API key / authentication by making a http request with the simplest tool you can e.g. [curl](https://curl.se/):

```auto
curl -v -u MY_API_KEY_HERE: "https://stream.companieshouse.gov.uk/companies"

```

(Note the trailing colon - this is because there is no password, the username is the API key).

If you get blocked here you either have an invalid API key OR it may be Companies House is objecting to the IP address / domain. You need to ensure that in your Application details you have set IP addresses / javascript domains for where you’re accessing from. (I think the javascript domains may be the issue for you). You can update your application here:

> **[Sign in to Companies House](https://identity.company-information.service.gov.uk/oauth2/user/email-and-password?request=eyJlbmMiOiJBMTI4Q0JDLUhTMjU2IiwiYWxnIjoiZGlyIn0..UJGJNaGV4d8YAw3RjanMMQ.DpI8fuKEKdTzMqOF0M6ZFPZd45_riuwLM1aQZ2xvUSUpGa2UTZn041iieTt0AwqltB4CuMY_lIQ_M5xnmef_G98mR-sacgD_Mm9zTA56eVgpEgUtE000sXYxKU32GxBCwCwHZ_1nL1fBldhL7PL8k6enWWRM0_3wbBrdwmvzyP9dl-ttrJMzzr-QYMf94iwFY-mXtqwiY6-SuCzmi4In3uz_aMliLroPVoQZic218NPYqnNki08Yo_YGVN9Mcswi4xiVGRqcC9xw5e3VG9qmx_eTiZG35480vCokU5gja1HpYkpY6uJ9NsptFGszdbLpsI-XB5qk989-7jGnazjBzkgR3qnUSQrRMhGcK6hkIdWX4XjGjTCnoIjlCkUIATnUHNwT6PoApEOhh90NXW6E81FQ6Fj2DatDYdcryhlYwNqbuFooN41xGjUPmZh-6u_QpgretYcwKe2YxyE4gGs_7546ltrMPrMGyNOKlCl8Vc116IoecycflTr0fvrEL0xJtXhMGSTue2Dl0QkecFhCJyv7PHc2yG2StmKm6ukdTsuXoVktcioJR2J7q6qXHDCXaPtRb4aAFk1qej91oa6XH16sm6EamT6-1IgZ7sNn0jPEBjFe8ZjcOsVVjNKAsO1LMg0K36ZnSlcKCagMgSLwf5RU1BygJvaeYAuwinq-rYXIRzzIC_Gi-pCrt6pDxvakr6FYkMLgO8I_qUw3jViknA.RpBBpw-iZ4NszmhZ3itG1g)**

If you’re doing this from a localhost environment this is possible - search this forum for instructions on a workaround for doing that.

I have no idea about doing this with Excel but again if you search the forum or google you may find some help. People have managed to make this work with (what appear to be) other “local” applications e.g. Microsoft Power BI.

---

<div class="post-metadata">

**Author:** ![jonmarkperry](http://forum.companieshouse.gov.uk/user_avatar/forum.companieshouse.gov.uk/jonmarkperry/32/1329_2.png) [@jonmarkperry](http://forum.companieshouse.gov.uk/u/jonmarkperry)\
**Post date:** [August 25, 2022, 2:27pm UTC](http://forum.companieshouse.gov.uk/t/problems-using-basic-authorization-with-streams/5384/7 "2022-08-25T14:27:01Z")

</div>

I got a partial solution, by abandoning stream and using RESTapi instead.

I logged on with Excel and curl ([Documents not downloading, invalid ID - #7 by csmith](https://forum.aws.chdev.org/t/documents-not-downloading-invalid-id/544/7)).

I also got JS/XHR to work - load the client-side file to your server and enter the domain into the ‘create key’ rest section under JavaScript domains.

Thanks for everyones help!