Errors
401 - missing Authorization header
What happened
The endpoint did not receive an Authorization bearer header. This is different from an expired token.
- Load the credentialRead the token from your configured secret source.
- Attach AuthorizationSend Bearer followed by the token.
- Check forwarding and accessEnsure the header reaches the API and inspect the response.
Request that triggers it
A request that omits the Authorization header entirely.
curl -X POST "https://$OC_HOST/v1/tenants/$OC_TENANT/sql" \
-H "Content-Type: application/json" \
-d '{"sql": "SELECT id FROM shop.products LIMIT 1"}'Read the response
{
"error": "unauthorized",
"message": "missing Authorization header",
"retry": false
}Fix the request
- Confirm the application loaded its secret.
- Set Authorization: Bearer followed by that token.
- Check that a proxy forwards the header.
- Retry the corrected request.
Keep in mind: Use the constructor and environment rules for your installed SDK version; do not assume all clients load OC_TOKEN automatically.
Common causes
- Token env var unset in CI - the script silently sent an empty value, which the proxy stripped.
- A reverse proxy or sidecar dropping the
Authorizationheader on forward. - Calling through a CDN cache that wasn't configured to forward auth headers.
- Pasted cURL from a docs page that didn't include the auth line.
- Frontend code that forgot to attach the token to
fetchoptions.
Continue
See error handling and retries, or return to error examples.