{"record":{"id":"24e06fa4949f98c5","repo":"hpyhacking/peatio","slug":"2001","errorCode":"2001","errorMessage":"Authorization failed","messagePattern":"Authorization failed","errorType":"exception","errorClass":"APIv2::AuthorizationError","httpStatus":401,"severity":"error","filePath":"app/api/api_v2/helpers.rb","lineNumber":5,"sourceCode":"module APIv2\n  module Helpers\n\n    def authenticate!\n      current_user or raise AuthorizationError\n    end\n\n    def redis\n      @r ||= KlineDB.redis\n    end\n\n    def current_user\n      @current_user ||= current_token.try(:member)\n    end\n\n    def current_token\n      @current_token ||= env['api_v2.token']\n    end\n\n    def current_market\n      @current_market ||= Market.find params[:market]\n    end\n","sourceCodeStart":1,"sourceCodeEnd":23,"githubUrl":"https://github.com/hpyhacking/peatio/blob/dab8641137c008928c835409342519bfef4eae7f/app/api/api_v2/helpers.rb#L1-L23","documentation":"Error code 2001 (AuthorizationError, 'Authorization failed') is raised by APIv2::Helpers#authenticate! when current_user is nil. current_user resolves to current_token.try(:member), and current_token is whatever the APIv2 auth middleware stored in env['api_v2.token']. So this error means the request ended up with no authenticated API token at all: the auth params were absent, or an earlier auth step (invalid/disabled/expired key, bad signature) failed so the token never got attached to the env.","triggerScenarios":"Calling an endpoint that invokes authenticate! without access_key/tonce/signature params; a prior auth failure leaving env['api_v2.token'] unset; the auth middleware not mounted before the Grape endpoint; a proxy or serializer dropping query/body params so the authenticator never sees the credentials.","commonSituations":"Porting a script from the session-cookie web UI to APIv2 without adding HMAC auth params; naming the credential access_token instead of access_key; signing params placed in the body while the endpoint reads the query string (or vice versa); test suites hitting protected endpoints without an auth helper.","solutions":["Send the complete auth param set on every call — access_key, tonce, signature, plus the endpoint's own params — all included in the signed payload","Look at the server log immediately above: an 'APIv2 auth failed: ...' line names the real reason (unknown key, bad signature) the token never attached","Verify the APIv2 auth middleware is mounted before the Grape app so env['api_v2.token'] is populated before helpers run"],"exampleFix":"# before — session-style call without API credentials\nget '/api/v2/members/me.json'\n\n# after — full signed request\nparams = auth_params.merge(access_key: ACCESS_KEY)\nparams[:tonce] = next_tonce\npayload = \"GET|/api/v2/members/me.json|#{URI.unescape(params.except(:format).to_query)}\"\nparams[:signature] = OpenSSL::HMAC.hexdigest('SHA256', SECRET_KEY, payload)\nget '/api/v2/members/me.json', params: params","handlingStrategy":"validation","validationCode":"# Guard: refuse to call protected endpoints unless auth material is complete\ndef assert_authenticated!(params)\n  %w[access_key tonce signature].each do |k|\n    raise \"missing auth param: #{k}\" if params[k].to_s.empty?\n  end\nend\nassert_authenticated!(params)\nget '/api/v2/members/me.json', params: params","typeGuard":null,"tryCatchPattern":"On 2001, stop the call chain and re-authenticate: dump the params actually sent (access_key present? tonce fresh? signature computed over those exact params?) and check the server log for the preceding 'APIv2 auth failed' line; blind retries with the same params always fail.","preventionTips":["Route every APIv2 call through one signed-request helper so no endpoint can be hit bare","Name the credential access_key, not access_token or api_key","Keep credentials in one config source and fail fast at startup if either half of the pair is missing","In tests, wrap protected endpoints with the same signing helper as production"],"tags":["ruby","grape","api-auth","authorization","middleware"],"backgroundTag":"missing-authentication-credentials","analyzedSha":"dab8641137c008928c835409342519bfef4eae7f","analyzedAt":"2026-08-23T09:59:18.005Z","schemaVersion":2},"datasetVersion":"2026-08-23T13:39:53.451Z"}