Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

Naimo's avatar
Level 2

Getting "Unauthenticated" response

I'm using laravel 5.4 and passport when I'm trying to consume my own API I get 401 code "Unauthenticated" I followed the documentation and nothing work so any help please !!

0 likes
16 replies
cedamorim's avatar

How are you trying to consume your api? If it is via ajax, remember to put the header Accept: application/json

Accept:application/json
Authorization:Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImp0aSI6ImI1MWE0MGRlOWE0NjYyZDE3ZDVkMTg4ZTVjNTdmZDk2ZjUzNzY4Y2IxNGI1MzgyMDcwYTY4MGQ1MzRmOGIyZjA0YzVlYmIzYjRkMWY0YjI2In0.eyJhdWQiOiIyIiwianRpIjoiYjUxYTQwZGU5YTQ2NjJkMTdkNWQxODhlNWM1N2ZkOTZmNTM3NjhjYjE0YjUzODIwNzBhNjgwZDUzNGY4YjJmMDRjNWViYjNiNGQxZjRiMjYiLCJpYXQiOjE0ODUxMDEyNzcsIm5iZiI6MTQ4NTEwMTI3NywiZXhwIjoxNTE2NjM3Mjc3LCJzdWIiOiIxIiwic2NvcGVzIjpbXX0.JsTdZKQCFrINhnxvn7_oLYcLGMNZLM0JFYqWP-pFIDcpa8q8rQgiUUy2x-n9laAP7Xlfzq17VGg41GdNjVTV6nzSubot2fpVX14xVUyIZo0CzppctxIs_T41k0YJh9yba7HtR1rQoI3oeOHQ4VmImSa-Y5yeQnVMOZju81Nae685w014B1GpxZuYf5e26ghdCM14YvCLcVAt3rLZKTNihv-l6vN6IxWR9K_KPaCmAFev0qjBMuN8YsUa7DkQxdH4rhZb-1GQmVqApkaCgTbRUVV5BvZBuVPzfxesetEBdl2jsVTpjuwe65St6aB-V-9PNudP5YpMcgkkLoyHqxQs9CLtZIJaRoPPEe0b1MRBYYUqaaEViT_MHTquVbvBw83-ykqYamaY0ognfhCIcB4w4MqquU2IqzujbBOiaUefytpV0_7Rb36ThrZSHs3N51l0MSXlXWQ-mtasD4MtOG_TuIC_N_xYOiDOLjX3Bqly7lnTR4IvPsQkXQEsHK7J6rh_clOGL9KWc0PEGQ_isjbrGBNmQ1SBFd8k8VF230OwKEw7Vs1fVDIxwyzi3LmfLzykneV39xNocuntKylkQU7b51oNB_eApJ5E1sflUM39ZiLTAWe4Mr6TdOWbuMWMvbt78V_tkebDAc7INuLqtuiT91WsHSrqvtF0QeCOG9KZAg0
fraserk's avatar

If you're using the API route middlewarr you have to pass in a api_token with the request.

Naimo's avatar
Level 2

@fraserk by api_token you mean laravel_token provided by CreateFreshApiToken middleware ??

Naimo's avatar
Level 2

@cedamorim in the documentation Authorization header is not necessary because CreateFreshApiToken middleware is provided and about Accept:application/json I tried that and not working

cedamorim's avatar

So you're using Passport. Type php artisan route: list and pass to us the result (just to check the guards)

How do you try to access your api? Via javascript? Show us an example, what your step by step and how you generate your token ... waiting for more information to try to help you

Naimo's avatar
Level 2

I'm trying to access '/api/user' route and middleware are set to 'api,auth:api '

I tried to access this route via Vue (axios)

here is my code for request

let uri = './api/user/'

      axios.get(uri)
      .then((response) => {
        this.mosquee = response.data

      }, (response) => {
        console.log(response)
      })

and token are generate automatically by CreateFreshApiToken middleware

thanks for your help, I hope that you understand what I'm saying here

rdelorier's avatar

In your dev tools network requests does your Ajax call send the cookie in the request

safiahmed4cs@gmail.com's avatar

@rdelorier

Yes,

Content-Type:application/json;charset=UTF-8 Cookie:XSRF-TOKEN=eyJpdiI6ImxrZWlZRERFeTlrVVdEajRuMWJjaGc9PSIsInZhbHVlIjoiV2tNVGZ2b3hYd0FRVklDOStSVGlFeURsSjU1QVZ0MitHcmxvXC9aSVlBUm1uMkhVa2JKd0ZraUJraXVLcUJIUkt6dWYxdnpcL3lPZGR4MXY0cW5xR2RPUT09IiwibWFjIjoiZmU1YWZkZjZjYWI5ZTgzNWRkNGM1ZTQzY2NhMTRjNjA0MWQ5ZTAxNWFmYmE3MzY2MDZkNTU0ZDVhM2ZjYWM2ZiJ9; laravel_session=eyJpdiI6Im1ZemZ1aStRWFd1c2tQVlNxZEtPT3c9PSIsInZhbHVlIjoiTkhOSkdHR1MwRkt5N0prT2VyZnk3eTdxeEJNQ2R5ZHRtWXZPTGM2TEFwTk9zYzVnMElyRHY2MmZMVWtHTDVzSFBhRlZ0NjUxZjY5c2kwc0ZEK0VDa0E9PSIsIm1hYyI6IjRjNTA3ZWZiYjYxN2ViYjExODYzYjc4ZGQ4NzRhYjQ4OTM3OTJiMjNhMWUzZWVjN2RkNjcyZDJmMDAzZjMyZTIifQ%3D%3D; laravel_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOjEsImNzcmYiOiJ6TDlaZVl6dTFqVTZSTjNFZ3FGbHlQSnpWRm1IcjhUYWZGclBobGZpIiwiZXhwaXJ5IjoxNDg1NzIwOTA2fQ.83p4ANAGpO2wxFISqEb228gB2NAS5lkyloh_T3pbfUo

cedamorim's avatar
Level 15

I was testing and I saw the problem the lack of the 'X-CSRF-TOKEN' header, which you usually include on the page. In the default installation of Laravel 5.4 you have these lines in "views/layouts/app.blade.php"

this

<! - CSRF Token ->
<meta name="csrf-token" content="{{ csrf_token() }}">

and

<!-- Scripts -->
   <script>
       window.Laravel = {!! json_encode([
           'csrfToken' => csrf_token(),
       ]) !!};
   </script>
        

Simply by adding the 'X-CSRF-TOKEN' header and not 'X-XSRF-TOKEN' (only making it clear)

To test, after you login run this in your console and see the result:

axios.get ('/api/user', {
   headers: {
     'X-CSRF-TOKEN': 'Token Here' // from js or meta
   }
})
cedamorim's avatar

No problem :D

Before I forget, two things are important here: The cookie "laravel_token" and the header "X-CSRF-TOKEN"

Please or to participate in this conversation.