{"record":{"id":"0249097713a3f1d4","repo":"ipfs/kubo","slug":"kubo-rpc-access-denied-please-provide-a-valid-aut","errorCode":null,"errorMessage":"Kubo RPC Access Denied: Please provide a valid authorization token as defined in the API.Authorizations configuration.","messagePattern":"Kubo RPC Access Denied: Please provide a valid authorization token as defined in the API\\.Authorizations configuration\\.","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"core/corehttp/commands.go","lineNumber":196,"sourceCode":"\t\tauthorizationHeader := r.Header.Get(\"Authorization\")\n\t\tauth, ok := authorizations[authorizationHeader]\n\n\t\tif ok {\n\t\t\t// version check is implicitly allowed\n\t\t\tif r.URL.Path == \"/api/v0/version\" {\n\t\t\t\tnext.ServeHTTP(w, r)\n\t\t\t\treturn\n\t\t\t}\n\t\t\t// everything else has to be safelisted via AllowedPaths\n\t\t\tfor _, prefix := range auth.AllowedPaths {\n\t\t\t\tif strings.HasPrefix(r.URL.Path, prefix) {\n\t\t\t\t\tnext.ServeHTTP(w, r)\n\t\t\t\t\treturn\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\thttp.Error(w, \"Kubo RPC Access Denied: Please provide a valid authorization token as defined in the API.Authorizations configuration.\", http.StatusForbidden)\n\t})\n}\n\n// CommandsOption constructs a ServerOption for hooking the commands into the\n// HTTP server. It will NOT allow GET requests.\nfunc CommandsOption(cctx oldcmds.Context) ServeOption {\n\treturn commandsOption(cctx, corecommands.Root)\n}\n\n// CheckVersionOption returns a ServeOption that checks whether the client ipfs version matches. Does nothing when the user agent string does not contain `/kubo/` or `/go-ipfs/`\nfunc CheckVersionOption() ServeOption {\n\tdaemonVersion := version.ApiVersion\n\n\treturn func(n *core.IpfsNode, l net.Listener, parent *http.ServeMux) (*http.ServeMux, error) {\n\t\tmux := http.NewServeMux()\n\t\tparent.HandleFunc(\"/\", func(w http.ResponseWriter, r *http.Request) {\n\t\t\tif strings.HasPrefix(r.URL.Path, APIPath) {\n\t\t\t\tcmdqry := r.URL.Path[len(APIPath):]","sourceCodeStart":178,"sourceCodeEnd":214,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/core/corehttp/commands.go#L178-L214","documentation":"The commands RPC middleware enforces API.Authorizations access control: if the request carries no valid authorization token matching the configured policy, the server responds 403 with this message. It protects the /api/v0/ RPC surface from unauthenticated access when Authorizations are configured.","triggerScenarios":"Calling any /api/v0/ endpoint without the required bearer/authorization token configured under API.Authorizations, or with an expired/incorrect token, while the daemon has Authorizations configured.","commonSituations":"Old scripts and clients predating Authorizations hitting a hardened daemon, tokens rotated in config but not in the calling service, reverse proxies stripping Authorization headers before they reach kubo.","solutions":["Add the correct Authorization header/token as defined in API.Authorizations on the daemon.","Re-read the current token after config changes: `ipfs config API.Authorizations`.","Ensure proxies/gateways forward the Authorization header to the daemon.","If this node is on a trusted private network only, remove/simplify API.Authorizations deliberately (with the security trade-off understood)."],"exampleFix":"// before\ncurl http://127.0.0.1:5001/api/v0/id\n// after\ncurl -H \"Authorization: Bearer <token-from-API.Authorizations>\" http://127.0.0.1:5001/api/v0/id","handlingStrategy":"try-catch","validationCode":"authCfg, _ := ipfsConfigFromPath(ipfsPath)\nif len(authCfg.API.Authorizations) > 0 && authToken == \"\" {\n\treturn errors.New(\"daemon requires an API token; set Authorization header\")\n}","typeGuard":null,"tryCatchPattern":"resp, err := httpClient.Post(\"http://127.0.0.1:5001/api/v0/id\", \"\", nil)\nif err != nil {\n\treturn err\n}\nif resp.StatusCode == http.StatusForbidden {\n\treturn errors.New(\"RPC access denied: refresh the API.Authorizations token\")\n}","preventionTips":["Read the token from the daemon config at client startup, not from a hardcoded copy","Rotate tokens in clients at the same time as config changes","Verify proxies forward the Authorization header to kubo","Handle 403 distinctly from other HTTP errors so operators see an auth problem, not a generic failure"],"tags":["http","rpc","auth","security"],"backgroundTag":"missing-auth-token","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}