Skip to main content

Connecting

The GRASS Runner talks to a FastGIS server. On the server that served the page to you, being signed in is all it needs — there is nothing to paste.

On this server: just sign in​

Sign in, open GRASS Runner, and it is already authenticated: the browser sends your session cookie with every request. The Connection panel's X-API-Key field can stay empty.

Click Connect & load environments to populate the Environment dropdowns.

:::note Why there is no token to copy The app used to require an API token pasted into that field, which meant the token sat in the browser's localStorage where any cross-site-scripting flaw on the page could read it. Since 2026-09-07 the web app authenticates with the session cookie it already holds, so there is no long-lived credential in browser storage to steal. :::

Pointing at a different server​

Set Base URL to the other server and paste a token from that server into X-API-Key. A cookie only authenticates the origin that issued it, so a token is the only way to reach a server other than the one hosting the page.

Getting an API token​

You need one for a different server, and for anything that is not a browser — QGIS and other OGC clients, the mobile app, curl, scripts. Those keep sending X-API-Key exactly as before.

  1. Sign in and go to Dashboard
  2. Click Generate Token
  3. Copy it — it is shown once
caution

One active token per account: generating a new one revokes the previous. Anyone holding the token can run GRASS modules as you.

Selecting an environment​

After connecting, choose a Location and Mapset from the dropdowns. The environment id shown below the selects (location/mapset) is used in all subsequent API calls.

What gets persisted​

The base URL is saved to localStorage, so the app reopens where you left it. A token typed into the Connection panel is saved alongside it — which is exactly why the same-origin path no longer asks for one. Leave that field empty unless you are reaching another server.

If a page says you cannot use the console​

The web console is a separate application for managers and fleet operators, and accounts need web_ui_access to enter it (administrators bypass the flag). Being signed in is not enough on its own: an account without it gets a page saying so. Rider accounts are expected to use the mobile app and the desktop companion instead.