# Bearer auth no longer available? \[resolved\]

**URL:** https://forum.syncthing.net/t/bearer-auth-no-longer-available-resolved/20696
**Category:** Support
**Created:** [August 20, 2023, 1:51pm UTC](https://forum.syncthing.net/t/bearer-auth-no-longer-available-resolved/20696 "2023-08-20T13:51:00Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![timabell](https://forum.syncthing.net/user_avatar/forum.syncthing.net/timabell/32/524_2.png) [@timabell](https://forum.syncthing.net/u/timabell)
#### Post date: [August 20, 2023, 1:51pm UTC](https://forum.syncthing.net/t/bearer-auth-no-longer-available-resolved/20696/1 "2023-08-20T13:51:01Z")

</div>

Hi,

For me the X-API-Key works but bearer auth does not.

I’m following the instructions for querying the REST API here: [REST API — Syncthing documentation](https://docs.syncthing.net/dev/rest.html)

It says:

> To use an API key, set the request header `X-API-Key` to the API key value, or set it as a `Bearer` token in the `Authorization` header.

Are the docs wrong / out of date? Am I doing something wrong? I’m happy to create a PR and remove the bearer auth from the docs if they are just wrong.

Here’s what I get:

403 for Bearer auth:

```bash
$ token=<redacted>
$ curl -v -H "Authorization: Bearer $token" http://localhost:8080/rest/system/version
* Trying 127.0.0.1:8080...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 8080 (#0)
> GET /rest/system/version HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/7.68.0
> Accept: */*
> Authorization: Bearer <redacted>
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 403 Forbidden
< Content-Type: text/plain; charset=utf-8
< X-Content-Type-Options: nosniff
< X-Frame-Options: SAMEORIGIN
< X-Syncthing-Id: ZFTGXBV-4244BM2-7NR2SAG-I4IXX2N-TLOP4R4-ZTH5Q77-GUU5O35-H32VVAC
< X-Syncthing-Version: v1.18.2
< X-Xss-Protection: 1; mode=block
< Date: Sun, 20 Aug 2023 13:41:35 GMT
< Content-Length: 11
< 
CSRF Error
* Connection #0 to host localhost left intact

```

200 OK for X-API-KEY

```plaintext
$ curl -v -H "X-API-KEY: $token" http://localhost:8080/rest/system/version           
* Trying 127.0.0.1:8080...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 8080 (#0)
> GET /rest/system/version HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/7.68.0
> Accept: */*
> X-API-KEY: <redacted>
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Access-Control-Allow-Origin: *
< Cache-Control: max-age=0, no-cache, no-store
< Content-Type: application/json; charset=utf-8
< Expires: Sun, 20 Aug 2023 13:41:39 GMT
< Pragma: no-cache
< X-Content-Type-Options: nosniff
< X-Frame-Options: SAMEORIGIN
< X-Syncthing-Id: ZFTGXBV-4244BM2-7NR2SAG-I4IXX2N-TLOP4R4-ZTH5Q77-GUU5O35-H32VVAC
< X-Syncthing-Version: v1.18.2
< X-Xss-Protection: 1; mode=block
< Date: Sun, 20 Aug 2023 13:41:39 GMT
< Content-Length: 421
< 
{
  "arch": "amd64",
  "codename": "Fermium Flea",
  "date": "2021-08-22T19:04:47+01:00",
  "isBeta": false,
  "isCandidate": false,
  "isRelease": true,
  "longVersion": "syncthing v1.18.2 \"Fermium Flea\" (go1.17 linux-amd64) teamcity@build.syncthing.net 2021-08-22 18:04:47 UTC [stnoupgrade]",
  "os": "linux",
  "stamp": "1629655487",
  "tags": [
    "stnoupgrade"
  ],
  "user": "teamcity",
  "version": "v1.18.2"
}
* Connection #0 to host localhost left intact

```

(I’m [troubleshooting stuck files](https://forum.syncthing.net/t/deleted-out-of-sync-items-syncthing-stuck/14971/8))

---

<div class="post-metadata">

### Author: ![imsodin](https://forum.syncthing.net/user_avatar/forum.syncthing.net/imsodin/32/3317_2.png) [@imsodin](https://forum.syncthing.net/u/imsodin)
#### Post date: [August 20, 2023, 2:45pm UTC](https://forum.syncthing.net/t/bearer-auth-no-longer-available-resolved/20696/2 "2023-08-20T14:45:35Z")

</div>

Support for `Authorization` header (besides x-api-key) has just been added - you probably aren’t on v1.23.7 yet.

---

<div class="post-metadata">

### Author: ![timabell](https://forum.syncthing.net/user_avatar/forum.syncthing.net/timabell/32/524_2.png) [@timabell](https://forum.syncthing.net/u/timabell)
#### Post date: [August 20, 2023, 2:57pm UTC](https://forum.syncthing.net/t/bearer-auth-no-longer-available-resolved/20696/3 "2023-08-20T14:57:36Z")

</div>

Ah, added rather than removed, yes, I’m still on v1.18.2. Thanks!

---

<div class="post-metadata">

### Author: ![Nummer378](https://forum.syncthing.net/user_avatar/forum.syncthing.net/nummer378/32/5958_2.png) [@Nummer378](https://forum.syncthing.net/u/Nummer378)
#### Post date: [August 20, 2023, 2:57pm UTC](https://forum.syncthing.net/t/bearer-auth-no-longer-available-resolved/20696/4 "2023-08-20T14:57:39Z")

</div>

> [@imsodin](#):
>
> v1.23.7

> [@timabell](#):
>
> `X-Syncthing-Version: v1.18.2`

The docs that best fit your (outdated) version are here: [REST API — Syncthing v1 documentation](https://docs.syncthing.net/v1.18.2/dev/rest.html)

---

<div class="post-metadata">

### Author: ![system](https://forum-uploads.syncthingcdn.net/original/2X/0/0b50e0a202b22ae6a67190759e8c868805b8ed9f.png) [@system](https://forum.syncthing.net/u/system)
#### Post date: [September 19, 2023, 2:58pm UTC](https://forum.syncthing.net/t/bearer-auth-no-longer-available-resolved/20696/5 "2023-09-19T14:58:30Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.