API Error 401: Unauthorized

An HTTP 401: Unauthorized error occurs when a request to the API could not be authenticated.

An HTTP 401: Unauthorized error occurs when a request to the API could not be authenticated. All requests to API resources must use some authentication scheme to prove access rights to the resource.

If you are receiving an HTTP 401: Unauthorized error, there are several possibilities for why it might be occurring:

• The authentication credentials are missing
• The authentication credentials are incorrect, or sent in a format the API doesn't accept
• The request carries more than one credential, such as both a Basic and a Bearer credential
• The authentication credentials belong to a token that has been revoked
• The authentication credentials belong to a token that has expired

Check that the authentication credentials you are passing along in the request are correct and belong to an active token.

Example

A call to the API that results in an HTTP 401: Unauthorized error looks like this:

{
  "errors": [
    "Unauthorized access"
  ],
  "status": 401
}

The "status": 401 key indicates the HTTP 401: Unauthorized error. The response also carries a WWW-Authenticate header naming the schemes the API accepts:

WWW-Authenticate: Basic realm="Bonsai API", Bearer realm="Bonsai API"

Troubleshooting

The API doesn't say which check failed, so work through the list above. Start with the token itself: in your account's API Tokens settings, check that the token's key is listed, that it isn't marked Expired, and when it was last used. The dashboard shows a token's secret only once, when it's created, so it can't be used to check the secret. If you no longer have the secret, create a new token and revoke the old one.

If you're sure that the credentials are correct, then you may want to try isolating the problem. Try making a curl call to the API and see what happens. For example, using Bearer authentication:

curl -s -v -H "Authorization: Bearer bonsai_<key>_<secret>" https://api.bonsai.io/clusters

If the request succeeds, then you have eliminated the API Token as the source of the problem, and it's likely an issue with how the application is making the call to the API.

If the request still fails, then you should consult the documentation for the authentication scheme you're using to check the format of the Authorization header. You can also use the -v flag in curl to see which headers and values are being passed with the request.

If all else fails, you can always contact support and we will be glad to assist.