Why are my API calls rejected with 401?

Every endpoint of the faktoora API requires authentication with an API key. If this key is missing from the request or is invalid, the API responds with HTTP status 401 and the message "Unauthorized request".

How authentication works

The API expects the key in the HTTP header X-API-KEY. According to the API documentation:

An API key is required to access the API. The API key (X-API-KEY) can be generated in your faktoora account settings.

Practically every endpoint needs this header, from creating an invoice (POST /invoices) and retrieving invoice data to managing customers, products and webhooks.

Typical causes of a 401 error

• The X-API-KEY header is missing from the request entirely.
• The header name is misspelled, for example X-API_KEY or X-APIKEY.
• The key is passed as a query parameter or in the body instead of as a header.
• The value sent is not a valid API key generated in your account.

Upper and lower case in the header name does not matter: HTTP treats header names as case-insensitive, so x-api-key and X-API-KEY are equivalent.

How to fix it

1. In your faktoora account, open the API Access section (available from the menu at your profile picture; this is the same section where you also set up webhooks).
2. Check whether an API key exists there, and generate a new one if needed.
3. Set the key in every request exactly as the header X-API-KEY: <your-key>.