POST method works in Postman, but returns the login page when using axios

[aliyar]

When I make a post request to the following URL in Postman, and pass the raw data below, I get a 201 status code and the price rule is created successfully. But, when I try the same thing with axios, the api returns a 200 status code and the response data is the html of the login page.

https://<apikey>:<password>@xxx.myshopify.com/admin/api/2020-07/price_rules.json

{
  "price_rule": {
    "title": "TESTPRICERULE2",
    "target_type": "line_item",
    "target_selection": "entitled",
    "allocation_method": "across",
    "value_type": "percentage",
    "value": "-100.0",
    "customer_selection": "all",
    "usage_limit": "1",
    "entitled_product_ids": ["5591610753175"],
    "starts_at": "2020-09-02T17:59:10Z"
  }
}

 
Here's how I'm making the post request with axios:

    const data = {
      price_rule: {
        title: "TESTPRICERULE2",
        value_type: "percentage",
        value: "-100.0",
        entitled_product_ids: ["5591610753175"],
        allocation_method: "across",
        once_per_customer: "false",
        usage_limit: "1",
        customer_selection: "all",
        target_type: "line_item",
        target_selection: "entitled",      
        starts_at: new Date()  
      }
    };

   const url = "https://<apikey>:<password>@xxx.myshopify.com/admin/api/2020-07/price_rules.json";
    axios.post(url, data).then(res => {
        console.log(res.data); // res.data is html
    });

[Jason]

Is this fair to assume you’re making an API call via the browser or is this server side code?

You’ll be exposing the key details to the public if client side so that’s pretty scary to begin with. As for the block, If sending via the browser it’s going to include cookies so will be blocked for good security reasons. 

If it is server side and you’re sure the details are protection, there’s an alternative approach but let’s cover off the assumptions above first.

[aliyar]

Thank you! I already figured it out. I had to pass the password as a content header.