How do I enable the XMRig HTTP API and access token?

You enable XMRig’s HTTP API by turning on the http section in its configuration file and setting an access-token. This lets you check your miner through HTTP requests, while the token acts like a password for access.

Set up the HTTP section

The HTTP API is a small service built into XMRig. It lets other software request information such as your mining speed, connection status, and accepted work.

Stop XMRig, then open the config.json file your miner actually uses. Find its "http" section and update it to look like this:

"http": {
    "enabled": true,
    "host": "127.0.0.1",
    "port": 18088,
    "access-token": "REPLACE_WITH_YOUR_RANDOM_SECRET",
    "restricted": true
}

This is a section of your existing configuration, not a complete mining configuration. Keep your pool and other settings. Make sure commas between sections remain correct.

Here is what each setting does:

• enabled turns the HTTP API on.
• host selects the address XMRig listens on. 127.0.0.1 allows access only from the same computer.
• port selects the connection number. 18088 is an example; choose an unused port.
• access-token sets your secret for authenticated requests.
• restricted limits API access to read-only operations. Keep it true if you only want monitoring.

Save the file and restart XMRig.

Choose a strong access token

Replace the example text with a long, randomly generated secret. A password manager can create one for you. Use at least 32 random letters and numbers, and do not reuse a pool password or website password.

XMRig does not require you to register this token anywhere. You choose it in the configuration, then provide the same value when making requests.

Treat both your configuration file and any saved monitoring scripts as sensitive if they contain the token. Do not share screenshots or logs that reveal it.

Test an authenticated request

On the computer running XMRig, use curl, a command-line tool for making web requests:

curl -H "Authorization: Bearer YOUR_RANDOM_SECRET" \
  http://127.0.0.1:18088/2/summary

Replace YOUR_RANDOM_SECRET with your configured token. Keep the word Bearer followed by one space.

The /2/summary endpoint—the API address for a mining summary—returns JSON, a structured text format. You should see mining statistics.

Typing that address into a browser’s address bar does not normally send the required authorization header. Use curl or an API client that supports headers instead.

If it fails:

• Connection refused: Check that XMRig restarted, loaded the correct configuration, and opened the expected port.
• Unauthorized: Check the token and the Authorization: Bearer header.
• No HTTP support: Your XMRig build may lack the HTTP feature. Use an official build that includes it.

Keep remote access private

Leave host as 127.0.0.1 unless you need access from another device.

For remote monitoring, prefer an SSH tunnel, which creates an encrypted connection to your miner. Plain HTTP does not encrypt your token or statistics.

Do not expose the port directly to the public internet. Setting restricted to false permits control operations; it is not needed for basic monitoring and increases the risk if someone obtains access.

The bottom line

Enable HTTP, bind it to localhost, set a strong token, and keep restricted mode on. Test with a Bearer-authenticated request before connecting your monitoring software.