Checkcraft401 Unauthorized in an API and Postman: why access is denied
A 401 means the server did not recognise you: credentials are missing, wrong or expired. The cause is usually the Authorization header or the token itself.
401 vs 403
401 Unauthorized: the server does not know who you are and asks you to authenticate. It should send a WWW-Authenticate header naming the scheme, for example Bearer. 403 Forbidden: the server knows you, but this user is not allowed to do it. A 401 needs a different or fresh token; a 403 needs different permissions.
Common causes
The header is not sent: in Postman the request is set to No Auth instead of Inherit auth from parent, so the collection auth is not applied. A format mistake: it must be Authorization: Bearer followed by a space and the token. The token has expired: decode it and check the exp field. The token is from another environment: issued by a test stand while the request goes to production. The request is redirected to another domain: clients drop Authorization on such a redirect, so the server gets the request without it.
curl -i https://api.example.com/me \
-H "Authorization: Bearer $TOKEN"unexpected status 401 Unauthorized
Tools print this when the server refuses authentication, for example Docker talking to an image registry. The meaning is the same: the credentials were not accepted. Log in again and check which address the tool calls and with which credentials.
The token in a request chain
To avoid copying the token by hand, the first request obtains it and the following ones reuse it. In Checkcraft a value from the response is saved to a variable and inserted into the next step’s header with no scripts, and a status check shows at once which step returned the 401.
Repeat this on your own API
Checkcraft is a desktop app that saves API response checks without code and shows what did not match. Start with a sample, then use your own sanitized data. Free runs on Windows and Linux with no time limit.
Download FreeDownload and first runNo sign-up or email needed, the archive is ready in a couple of minutes. See the edition limits.
References
Start with the linked example and compare its result with your own test requirement.