+++
title = "API Error 401: Unauthorized"
weight = 102
updated = 2026-10-07
aliases = ["/docs/api-error-401-unauthorized.html", "/docs/bonsai-api/errors/401-unauthorized/", "/docs/api/errors/401-unauthorized/"]

[extra]
nav_title = "API Error 401: Unauthorized"
weight = 10
+++

{{ legacy_api_notice() }}

An HTTP 401: Unauthorized error occurs when a request to the API could not be authenticated.

An HTTP 401: Unauthorized error occurs when a request to the API could not be authenticated. All requests to API resources must use some [authentication scheme](@/docs/api/legacy/authentication/overview/index.md) to prove access rights to the resource.

If you are receiving an HTTP 401: Unauthorized error, there are several possibilities for why it might be occurring:

- The authentication credentials are missing
- The authentication credentials are incorrect, or sent in a format the API doesn't accept
- The request carries more than one credential, such as both a Basic and a Bearer credential
- The authentication credentials belong to a token that has been revoked
- The authentication credentials belong to a token that has expired

Check that the authentication credentials you are passing along in the request are correct and belong to an active token.

## Example

A call to the API that results in an HTTP 401: Unauthorized error looks like this:

```json
{
  "errors": [
    "Unauthorized access"
  ],
  "status": 401
}
```

The `"status": 401` key indicates the HTTP 401: Unauthorized error. The response also carries a `WWW-Authenticate` header naming the schemes the API accepts:

```
WWW-Authenticate: Basic realm="Bonsai API", Bearer realm="Bonsai API"
```

## Troubleshooting

The API doesn't say which check failed, so work through the list above. Start with the token itself: in your account's **API Tokens** settings, check that the token's key is listed, that it isn't marked **Expired**, and when it was last used. The dashboard shows a token's secret only once, when it's created, so it can't be used to check the secret. If you no longer have the secret, [create a new token](@/docs/account/api-tokens/index.md) and revoke the old one.

If you're sure that the credentials are correct, then you may want to try isolating the problem. Try making a curl call to the API and see what happens. For example, using [Bearer authentication](@/docs/api/legacy/authentication/using-bearer-authentication/index.md):

```bash
curl -s -v -H "Authorization: Bearer bonsai_<key>_<secret>" https://api.bonsai.io/clusters
```

If the request succeeds, then you have eliminated the API Token as the source of the problem, and it's likely an issue with how the application is making the call to the API.

If the request still fails, then you should consult the documentation for the [authentication scheme](@/docs/api/legacy/authentication/overview/index.md) you're using to check the format of the `Authorization` header. You can also use the `-v` flag in curl to see which headers and values are being passed with the request.

If all else fails, you can always [contact support](mailto:support@bonsai.io) and we will be glad to assist.