<p>Have your cron job pass in a super-duper top-secret key via the querystring.</p>

<pre><code>yoursite.com/actions/pluginHandle/pluginAction?key=youwillneverguessme
</code></pre>

<p>You can use a site like <a href="http://www.guidgen.com/" rel="nofollow">www.guidgen.com</a> to generate the key.</p>

<p>Then just have your action check for that key, make sure it matches and bail if it doesn't.</p>

CC BY-SA 3.0
2015-11-19T17:44:38.347Z
Thanks Brad, does my updated question look like it would work to you?
H2ONOCK
CC BY-SA 3.0
2015-11-19T17:50:17.867Z
Looks good to me!
Brad Bell
CC BY-SA 3.0
2015-11-19T16:26:10.327Z
2015-11-19T16:26:10.327Z
Brad Bell
<p>Along with Brad's answer, one additional easy check in your code would be to see if the <code>$_SERVER['REMOTE_ADDR']</code> is the server's IP and then bail if it's not.</p>

<p>That means you'd have to spoof the server's IP address AND guess the key. No better than a username/password combination but should be secure enough IMO.</p>

CC BY-SA 3.0
2015-11-19T16:35:12.010Z
2015-11-19T16:35:12.010Z
RitterKnight
<p>I've created an action that calls a service. The action will be called by a cron task. I want to set this up so that ONLY the cron task can call the action. It's important that it can not be run by any other means (via HTTP, CURL request etc.).</p>

<p>Any ideas on how to do that?</p>

<p>UPDATED (I think this will work):</p>

<pre><code>public function actionMethod() 
{
    $this-&gt;requireAjaxRequest();

    $key = craft()-&gt;request-&gt;getParam('key');

    if($key == 'random-string' &amp;&amp; $_SERVER['REMOTE_ADDR'] == 'my-servers-ip-address') {
        craft()-&gt;plugin_name-&gt;actionMethod();
    }

}
</code></pre>

<p>Note, this is twinned with a cron tab that looks like:
<code>curl -H "X-Requested-With: XMLHttpRequest" http://sitename.co.uk/actions/plugin_name/Method?key=random-string</code></p>

<services><cron>
How do I make a service only runable by the server?
# How do I make a service only runable by the server?

(Asked by: username_0 on 2015-11-19)

I've created an action that calls a service. The action will be called by a cron task. I want to set this up so that ONLY the cron task can call the action. It's important that it can not be run by any other means (via HTTP, CURL request etc.).
Any ideas on how to do that?
UPDATED (I think this will work):
public function actionMethod() 
{
    $this->requireAjaxRequest();

    $key = craft()->request->getParam('key');

    if($key == 'random-string' && $_SERVER['REMOTE_ADDR'] == 'my-servers-ip-address') {
        craft()->plugin_name->actionMethod();
    }

}

Note, this is twinned with a cron tab that looks like:
curl -H "X-Requested-With: XMLHttpRequest" http://sitename.co.uk/actions/plugin_name/Method?key=random-string

**Tags:** services, cron


---

## 2 answers

### Answer by username_1 on 2015-11-19. Score: 0 | Accepted answer

Have your cron job pass in a super-duper top-secret key via the querystring.
yoursite.com/actions/pluginHandle/pluginAction?key=youwillneverguessme

You can use a site like www.guidgen.com to generate the key.
Then just have your action check for that key, make sure it matches and bail if it doesn't.

> **Comments:**
> **username_0**: Thanks Brad, does my updated question look like it would work to you?  
> **username_1**: Looks good to me!  

---

### Answer by username_2 on 2015-11-19. Score: 1

Along with Brad's answer, one additional easy check in your code would be to see if the `$_SERVER['REMOTE_ADDR']` is the server's IP and then bail if it's not.

That means you'd have to spoof the server's IP address AND guess the key. No better than a username/password combination but should be secure enough IMO.


---

