> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.itential.com/adapters/authentication/patterns/dynamic-user-per-request/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.itential.com/_mcp/server.

# Dynamic user per request

> How to pass user credentials dynamically on each request so the adapter authenticates as the individual user making the call rather than a shared system account.

## Scenario

This system authenticates based on the identity of the person making the request rather than a shared system account. User credentials must be passed into the adapter method on each call and used to override the credentials in the service instance configuration for that call only.

The adapter library handles this via `callProperties` in the `reqObj` — no changes to the library are needed. However, code changes in `adapter.js` and `pronghorn.json` are required.

Even when credentials are passed dynamically, you should still provide values in the service instance configuration. The adapter may not start up if these fields are empty.

## Configuration

### adapter.js

Accept a `credentials` object in the method signature (containing `dynuser` and `dynpass`). Set the values in `callProperties.authentication` on the `reqObj`. The adapter library will use these credentials instead of the ones defined in the service instance configuration for this call only.

Using a single object parameter rather than two separate parameters makes it easier to add fields in the future.

```javascript
getMyData(query, credentials, callback) {

  // ...

  const reqObj = {
    payload: { garbage: 'need since post' },
    uriPathVars: [groupId, deviceId],
    uriQuery: { name: 'anyname' },
    uriOptions: { page: 2 },
    addlHeaders: { audit: 'turnOn' },
    authData: {},
    callProperties: {
      authentication: {
        username: credentials.dynuser,
        password: credentials.dynpass
      }
    },
    filter: '[*name=doggie]'
  };
```

### pronghorn.json

Add the `credentials` input parameter to each affected method in `pronghorn.json` so it can be passed in from anItential Platform workflow.

```json
{
  "name": "getMyData",
  "summary": "get my data from blah",
  "description": "get my data from blah",
  "input": [
    {
      "name": "query",
      "type": "object",
      "info": "object containing query fields",
      "required": false,
      "schema": {
        "title": "query",
        "type": "object"
      }
    },
    {
      "name": "credentials",
      "type": "object",
      "info": "Should contain 2 fields - dynuser and dynpass",
      "required": true,
      "schema": {
        "title": "credentials",
        "type": "object"
      }
    }
  ],
  "output": {
    "name": "result",
    "type": "object",
    "description": "A JSON Object containing status, code and the result"
  },
  "route": {
    "verb": "POST",
    "path": "/getMyData"
  },
  "roles": ["admin"],
  "task": true
}
```

> How to pass user credentials dynamically on each request so the adapter authenticates as the individual user making the call rather than a shared system account.