Authentication required

​

When it happens

• No Authorization header.
• Only an X-API-Key header. Send the key as Authorization: Bearer <key> instead.
• A key in the query string, under any parameter name (api_key, access_token, key, token, …). Such keys are rejected even when valid, and removed from our logs.
• An unknown or malformed key.
• Your IP address is temporarily blocked: after 20 lookups of unknown keys from one address within a minute, requests from it get this error for 5 minutes, with a Retry-After header. A valid key that was used successfully within the last minute may still get through.

​

What to do

​

Example

HTTP/1.1 401 Unauthorized
Content-Type: application/problem+json
WWW-Authenticate: Bearer realm="api.pinakelai.com", error="invalid_token"

{
  "type": "https://docs.pinakelai.com/errors/unauthenticated",
  "title": "Authentication required",
  "status": 401,
  "detail": "Unknown API key.",
  "request_id": "req_01M7Q40D4E5F6G7H8J9KMNPQRS"
}