# 401 Authorization Error on API access

**URL:** <https://community.shiphero.com/t/401-authorization-error-on-api-access/2747>\
**Category:** GraphQL API\
**Created:** [December 26, 2023, 9:33pm UTC](https://community.shiphero.com/t/401-authorization-error-on-api-access/2747 "2023-12-26T21:33:45Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![johni](https://avatars.discourse-cdn.com/v4/letter/j/b38774/32.png) [@johni](https://community.shiphero.com/u/johni)\
**Post date:** [December 26, 2023, 9:33pm UTC](https://community.shiphero.com/t/401-authorization-error-on-api-access/2747/1 "2023-12-26T21:33:45Z")

</div>

I am writing an interface from our internal order entry to the shiphero API and I can’t get past the transport layer error 401. I do have a token and I think I have created the appropriate headers but I suspect that the authorization header is not quite correct. Is there a sample anywhere of what the proper headers and format are? Failing that, how would I go about debugging this? Our logistics company is the shiphero user and just changed this month so they can’t give us a lot of technical help.

---

<div class="post-metadata">

**Author:** ![sh-agent](https://avatars.discourse-cdn.com/v4/letter/s/e47774/32.png) [@sh-agent](https://community.shiphero.com/u/sh-agent)\
**Post date:** [December 27, 2023, 2:41pm UTC](https://community.shiphero.com/t/401-authorization-error-on-api-access/2747/2 "2023-12-27T14:41:29Z")

</div>

Hey @johni,

Thanks for reaching out!

Would you mind sharing with me the full request/response along with the headers that you are using to make the attempted call?

I’ve started a private message between us, to continue this further.

Best,  
RayanP

---

<div class="post-metadata">

**Author:** ![johni](https://avatars.discourse-cdn.com/v4/letter/j/b38774/32.png) [@johni](https://community.shiphero.com/u/johni)\
**Post date:** [December 27, 2023, 6:08pm UTC](https://community.shiphero.com/t/401-authorization-error-on-api-access/2747/3 "2023-12-27T18:08:32Z")

</div>

Thanks Ryan:

I’m a little bit out of my element here but I think what I should be doing is:

using https as the protocol, I have to add headers as follows:

[header] =\> Array  
(  
[0] =\> “Content-type”: “application/json”

```
                [1] => "Content-Length": 171

                [2] => "User-Agent":"Mozilla/5.0" + "Linux x86_64; Gecko/0100101

```

Firefox/58.0"\r\n  
[3] =\> “Authorization”: "Bearer  
",“expires\_in”:2419200,“refresh\_token”:“XfU4IkxtIPnAM0unWaRSdi  
kEfqCmHpIE5LnEQo8JgmzKS”,“scope”:"openid profile view:products change:products view:orders  
change:orders view:purchase\_orders change:purchase\_orders view:shipments change:shipments  
view:returns change:returns view:warehouse\_products change:warehouse\_products view:picking\_stats  
view:packing\_stats offline\_access  
"\r\n

I’m just sending some simplistic content to check that I have a connection (I don’t have yet) so the  
content is:

[content] =\>  
0=%22%7Bquery+%7Buuid%28%5C%22legacy\_id%5C%22%3A%5C%22100579698%5C%22%2C%5C%22entity%5C%22%3A%5C%22o  
rder%5C%22%29%7D%2C%7Bdata%3A+%7B%5C%22legacy\_id%5C%22%3A12345%7D%7D%22

The response that I get from shiphero is:

====Dumping response header====  
array(6) {  
[0]=\>  
string(25) “HTTP/1.1 401 UNAUTHORIZED”  
[1]=\>  
string(35) “Date: Wed, 27 Dec 2023 17:53:29 GMT”  
[2]=\>  
string(38) “Content-Type: text/html; charset=utf-8”  
[3]=\>  
string(18) “Content-Length: 47”  
[4]=\>  
string(17) “Connection: close”  
[5]=\>  
string(13) “Server: nginx”  
}

====end of response header===

I am writing in PHP since this is triggered from the server when an order is placed and everything  
else there is in PHP. I cribbed the header format from the Python example in the docs.

Other information that might be useful:

O/S - Rocky Linux 9.2 (ie RHEL 9.1)  
PHP version: 8.0.30  
Apache 2.4.53 (but at the moment I am running from the command line)

The token shown in the headers above is the company’s live token but at the moment HyperNile (the  
actual shiphero user) knows not to ship anything for us that turns up on their new system. Before  
we go live I will refresh it.

Please let me know if you need anything else.

Regards,

John

---

<div class="post-metadata">

**Author:** ![johni](https://avatars.discourse-cdn.com/v4/letter/j/b38774/32.png) [@johni](https://community.shiphero.com/u/johni)\
**Post date:** [December 29, 2023, 7:17pm UTC](https://community.shiphero.com/t/401-authorization-error-on-api-access/2747/4 "2023-12-29T19:17:07Z")

</div>

Hi Rayanp: Any ideas yet or should I provide additional information? Our logistics company is changing to ship-hero next week at the start of the new year.

---

<div class="post-metadata">

**Author:** ![sh-agent](https://avatars.discourse-cdn.com/v4/letter/s/e47774/32.png) [@sh-agent](https://community.shiphero.com/u/sh-agent)\
**Post date:** [January 2, 2024, 12:43pm UTC](https://community.shiphero.com/t/401-authorization-error-on-api-access/2747/5 "2024-01-02T12:43:23Z")

</div>

Hey @johni,

Contining this conversation via PM.

Best,  
RayanP