I wrote the following to interact with a Geth node. Got Error: authentication needed: password or unlock. Is there any way to bypass that? I don't want to use private key in my code either. Can I interact with the node directly to send transaction or sign message?

var Web3 = require('web3');
var web3 = new Web3(new Web3.providers.HttpProvider(''));

    from: "0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    to: "0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", 
    value: web3.toWei(2, "ether"), 
    nonce: '0x1',
    gasPrice: '0x5b9aca00',
    gasLimit: '0x56f90',
}, function(err, transactionHash) {
    if (err) { 
    } else {

2 Answers 2


Better try to use ethereum transaction builed library for generating and signing transaction offline. And after just call sendSignedTransaction method:

var Tx = require('ethereumjs-tx');
var privateKey = new Buffer('e331b6d69882b4cb4ea581d88e0b604039a3de5967688d3dcffdd2270c0fd109', 'hex')

var rawTx = {
  nonce: '0x00',
  gasPrice: '0x09184e72a000',
  gasLimit: '0x2710',
  to: '0x0000000000000000000000000000000000000000',
  value: '0x00',
  data: ''

var tx = new Tx(rawTx);

var serializedTx = tx.serialize();

// console.log(serializedTx.toString('hex'));
// 0xf889808609184e72a00082271094000000000000000000000000000000000000000080a47f74657374320000000000000000000000000000000000000000000000000000006000571ca08a8bbf888cfa37bbf0bb965423625641fc956967b81d12e23709cead01446075a01ce999b56a8a88504be365442ea61239198e23d1fce7d00fcfc5cd3b44b7215f

web3.eth.sendSignedTransaction('0x' + serializedTx.toString('hex'))
.on('receipt', console.log);
.on('transactionHash', console.log
.on('error', console.log)

In web3 1.0 :

web3.eth.personal.unlockAccount(address, password, 60)
.then((response) => {
}).catch((error) => {

unlocks an account for 60 seconds with the provided password. There is no way to bypass that, for the reason of security. Never unlock your account longer than necessary, if you allow RPC connections from any IP. This would allow anyone to do transactions from your wallet.

  • Better teach this dude to sign the transaction before sending it. With unlockAccount there are two security breaches: 1. Since you send the password, you must use a secured connection (e.g. HTTPS). 2. Since the account remains unlocked for a certain period of time, you must ensure that no one else but you can access the node (I've read about an attack that took leverage of a system which kept an account unlocked for 2 seconds at a time). Commented Jul 3, 2018 at 8:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.