BookStackApp/BookStack · error · ApiAuthException

errors.api_no_authorization_found

Error message

errors.api_no_authorization_found

What it means

validateTokenHeaderValue() throws ApiAuthException(trans('errors.api_no_authorization_found')) when the extracted authorization token string is empty — i.e. the request carried no usable Authorization header. A companion check for the 'Token ' prefix and ':' separator raises the api_bad_authorization_format error instead.

Source

Thrown at app/Api/ApiTokenGuard.php:106

        $this->validateToken($token, $secret);

        if ($this->loginService->awaitingEmailConfirmation($token->user)) {
            throw new ApiAuthException(trans('errors.email_confirmation_awaiting'));
        }

        return $token->user;
    }

    /**
     * Validate the format of the token header value string.
     *
     * @throws ApiAuthException
     */
    protected function validateTokenHeaderValue(string $authToken): void
    {
        if (empty($authToken)) {
            throw new ApiAuthException(trans('errors.api_no_authorization_found'));
        }

        if (!str_contains($authToken, ':') || !str_starts_with($authToken, 'Token ')) {
            throw new ApiAuthException(trans('errors.api_bad_authorization_format'));
        }
    }

    /**
     * Validate the given secret against the given token and ensure the token
     * currently has access to the instance API.
     *
     * @throws ApiAuthException
     */
    protected function validateToken(?ApiToken $token, string $secret): void
    {
        if ($token === null) {
            throw new ApiAuthException(trans('errors.api_user_token_not_found'));
        }

View on GitHub (pinned to 18f8469a1c)

Solutions

1. Set the Authorization header to 'Token id:secret' on every API request.
2. Verify with curl -v or the client's debug output that the header is actually sent.
3. Check proxy/server config (e.g. nginx, Apache mod_headers, Cloudflare) for rules stripping Authorization; add the header to CORS Access-Control-Allow-Headers if applicable.
4. Ensure you are calling the /api routes (web routes do not use this guard).

Example fix

// before
curl https://example.com/api/books
// after
curl -H "Authorization: Token abc123:secret456" https://example.com/api/books

$authToken = $request->header('Authorization');
if (empty($authToken)) {
    throw new InvalidArgumentException('Authorization header is required for API calls.');
}

try {
    $response = $client->get($apiUrl);
} catch (ApiAuthException $e) {
    if ($e->getCode() === 401) {
        // inspect that the Authorization header was actually sent
    }
    throw $e;
}

When it happens

Trigger: API request made without an Authorization header at all, or with a header stripped by a proxy/load-balancer, or with a client that sets an empty Authorization value.

Common situations: Forgetting to set the Authorization header in an HTTP client; CORS preflight or reverse proxy (nginx/Cloudflare) dropping the Authorization header; using a header name like X-API-Key instead of Authorization; frameworks requiring an explicit header allow-list.

Related errors

• Unauthorized
• errors.email_confirmation_awaiting
• errors.api_bad_authorization_format
• errors.api_user_token_not_found
• errors.api_incorrect_token_secret

AI-assisted analysis of BookStackApp/BookStack@18f8469a1c (2026-09-02). Data as JSON: /api/errors/26dc080e2eed954d. Report an issue: GitHub.