Skip to main content
Problem type: https://docs.nordicfinancialnews.com/problems/auth-invalid
The API returns this problem type with HTTP 401 when it cannot authenticate your request. Four things produce it:
  • No Authorization header on the request.
  • An Authorization header that is not in Bearer YOUR_API_KEY form.
  • A key that matches nothing on record.
  • A key that matches but is no longer usable, because it was revoked, deactivated, or has passed its expiry date.
detail reads the same in all four cases, and nothing else in the response narrows it down. Work through the four causes yourself rather than expecting the response to name one.

​
Example response

No WWW-Authenticate header accompanies this response. A client that waits for an authentication challenge before attaching credentials will wait forever, so send the Authorization header on the first request.

​
How to fix it

Retrying will not help. Nothing about this condition changes on its own, so fix the request or the key before calling again.
  1. Confirm the header is spelled Authorization and its value starts with Bearer followed by a space, then the key.
  2. Confirm you are sending the key itself rather than its name or ID.
  3. Check the key is still listed and active in API key settings. A revoked or expired key fails exactly like a wrong one.
If one endpoint returns 401 while another returns 200 for the same key, the problem is not the key. Look at how that request is built instead.

​
Not the same as a 403

A 401 means the API does not know who you are. A 403 means it does, and is refusing anyway: either your key lacks the scope the endpoint requires, which is insufficient permissions, or your plan does not reach the resource, which is plan limit exceeded. Adding a valid key fixes a 401 and never fixes a 403.
Last modified on September 8, 2026