> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nordicfinancialnews.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication required

> The 401 problem type returned when a request carries no usable API key.

<Info>
  Problem type: `https://docs.nordicfinancialnews.com/problems/auth-invalid`
</Info>

The API returns this problem type with HTTP `401` when it cannot authenticate your request. Four things produce it:

* No `Authorization` header on the request.
* An `Authorization` header that is not in `Bearer YOUR_API_KEY` form.
* A key that matches nothing on record.
* A key that matches but is no longer usable, because it was revoked, deactivated, or has passed its expiry date.

`detail` reads the same in all four cases, and nothing else in the response narrows it down. Work through the four causes yourself rather than expecting the response to name one.

## Example response

```json theme={"dark"}
{
  "type": "https://docs.nordicfinancialnews.com/problems/auth-invalid",
  "title": "Authentication required",
  "status": 401,
  "detail": "Missing or invalid API key",
  "instance": "urn:request:7f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c"
}
```

No `WWW-Authenticate` header accompanies this response. A client that waits for an authentication challenge before attaching credentials will wait forever, so send the `Authorization` header on the first request.

## How to fix it

Retrying will not help. Nothing about this condition changes on its own, so fix the request or the key before calling again.

1. Confirm the header is spelled `Authorization` and its value starts with `Bearer` followed by a space, then the key.
2. Confirm you are sending the key itself rather than its name or ID.
3. Check the key is still listed and active in [API key settings](https://nordicfinancialnews.com/settings/api_keys). A revoked or expired key fails exactly like a wrong one.

If one endpoint returns `401` while another returns `200` for the same key, the problem is not the key. Look at how that request is built instead.

## Not the same as a 403

A `401` means the API does not know who you are. A `403` means it does, and is refusing anyway: either your key lacks the scope the endpoint requires, which is [insufficient permissions](/problems/auth-insufficient), or your plan does not reach the resource, which is [plan limit exceeded](/problems/plan-limit-exceeded). Adding a valid key fixes a `401` and never fixes a `403`.

## Related

* [Authentication](/guides/authentication) for how keys, scopes and headers work
* [Error handling](/guides/errors) for the full problem type list