> For the complete documentation index, see [llms.txt](https://docs.apismart.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.apismart.ai/troubleshooting/api-token-and-authentication-issues.md).

# API Token and Authentication Issues

API authentication errors usually occur when the API Token is invalid, missing, incorrectly configured, or no longer available.

When authentication fails, check the API Token, request headers, and account status before troubleshooting further.

For general error codes, see [**HTTP Status Codes and API Errors**](/troubleshooting/http-status-codes-and-api-errors.md).

***

### Check Your API Token

Before troubleshooting authentication issues, confirm:

* The API Token exists and is active.
* The correct API Token is being used.
* The Token has not been deleted or disabled.
* The Token belongs to the expected ApiSmart account.

If you have multiple API Tokens, verify that your application is using the intended Token.

***

### Verify the Authorization Header

ApiSmart requests require an Authorization header.

The format should be:

```http
Authorization: Bearer YOUR_API_TOKEN
```

Common formatting problems:

| Problem                    | Example                           |
| -------------------------- | --------------------------------- |
| Missing `Bearer`           | `Authorization: YOUR_API_TOKEN`   |
| Extra spaces or characters | `Bearer YOUR_API_TOKEN`           |
| Using an incomplete Token  | Copied only part of the Token     |
| Using an old Token         | Token was regenerated or disabled |

***

### Common Authentication Errors

#### 401 Unauthorized

A `401` response usually means authentication failed.

Check:

* API Token value
* Authorization header format
* Whether the Token is active
* Whether the request uses the correct environment variable

Example:

```
401 Unauthorized
Invalid authentication credentials
```

***

#### 403 Forbidden

A `403` response means the request was rejected.

Possible causes include:

* Account or Token restrictions
* Token status issues
* Access limitations

Check the returned error message and review the related request in [**Usage Logs and Costs**](/api-usage/usage-logs-and-costs.md).

***

### API Token Not Working After Creation

If a newly created Token does not work:

1. Confirm the Token was copied correctly.
2. Check that the application is using the latest Token value.
3. Restart your application if the Token is loaded from an environment variable.
4. Send a new test request.

Avoid using a Token copied from an old configuration or previous environment.

***

### API Token Works Locally but Fails in Production

If the same application works locally but fails after deployment, check:

* Environment variables are configured correctly.
* The production environment has the latest Token.
* The application is not using a different configuration file.
* The Token was not accidentally removed during deployment.

For security reasons, never place API Tokens directly in frontend code.

***

### Check Usage Logs

If authentication appears correct but requests still fail:

1. Open **Usage Logs**.

<figure><img src="/files/ZIkcAcnUVNW7HNhkA7Yl" alt=""><figcaption></figcaption></figure>

2. Find the failed request.
3. Check:
   * Request ID
   * Status
   * Error Message
   * Token Name
   * Model

This helps confirm whether the request reached ApiSmart.

***

### Contact Support

If the issue continues, provide:

* Request ID
* API endpoint
* Request time
* HTTP status code
* Error message
* Token Name (not the Token value)

Do not provide:

* Full API Token
* Account password
* Payment information

> 🔐 Never provide your full API Token to support.

***

### 🚀 Next Steps

Continue with:

* [**Create and Manage API Tokens**](/api-tokens/create-and-manage-api-tokens.md)
* [**Secure Your API Tokens**](/api-tokens/secure-your-api-tokens.md)
* [**HTTP Status Codes and API Errors**](/troubleshooting/http-status-codes-and-api-errors.md)
* [**Usage Logs and Costs**](/api-usage/usage-logs-and-costs.md)
* [**Model and Request Errors**](/troubleshooting/model-and-request-errors.md)