Unauthenticated

What it means

No credential was presented in the Authorization header, or the API key or OAuth token is unknown, revoked, expired, or for another resource. WWW-Authenticate names the resource_metadata to discover the authorization server from.

What to do

Send Authorization: Bearer <key or token>. For a key, check it on Settings → API keys (revoked or expired keys stop at once). For an OAuth token, refresh it, or follow resource_metadata in WWW-Authenticate and authorize again.

Example

Sent as application/problem+json with status 401. detail varies with the request; branch on type.

{
  "type": "https://impartire.com/problems/unauthenticated",
  "title": "Unauthenticated",
  "status": 401,
  "detail": "This API key is not recognised: it was revoked, has expired, or was never issued.",
  "instance": "/api/v1/me",
  "request_id": "01JB8Z5W6Q4N3X2V1T0S9R8P7M"
}