# API access always returns 401 Invalid credentials

**URL:** <https://discuss.huggingface.co/t/api-access-always-returns-401-invalid-credentials/162805>\
**Category:** Beginners\
**Created:** [July 13, 2025, 2:59am UTC](https://discuss.huggingface.co/t/api-access-always-returns-401-invalid-credentials/162805 "2025-07-13T02:59:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![topdev21](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/topdev21/32/51017_2.png) [@topdev21](https://discuss.huggingface.co/u/topdev21)\
**Post date:** [July 13, 2025, 2:59am UTC](https://discuss.huggingface.co/t/api-access-always-returns-401-invalid-credentials/162805/1 "2025-07-13T02:59:38Z")

</div>

Hello, I recently created a Hugging Face account and verified my email. I have generated multiple access tokens with read permissions, but every attempt to call the API endpoint [https://huggingface.co/api/whoami](https://huggingface.co/api/whoami) fails with:

{“error”:“Invalid credentials in Authorization header”}

I’ve tried:

- Multiple tokens
- Logging out and logging back in
- Deleting cookies and trying from incognito mode
- Verifying that the token is active
- Using curl and Python requests

But nothing works. Could you check if my account has an API restriction or if something else is wrong?

Thank you.

---

<div class="post-metadata">

**Author:** ![John6666](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/john6666/32/27664_2.png) [@John6666](https://discuss.huggingface.co/u/John6666)\
**Post date:** [July 13, 2025, 4:05am UTC](https://discuss.huggingface.co/t/api-access-always-returns-401-invalid-credentials/162805/2 "2025-07-13T04:05:24Z")

</div>

Try [https://huggingface.co/api/whoami-v2](https://huggingface.co/api/whoami-v2)  
[Hub API Endpoints](https://huggingface.co/docs/hub/api#get-apiwhoami-v2)

---

<div class="post-metadata">

**Author:** ![Angelina067](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/angelina067/32/51060_2.png) [@Angelina067](https://discuss.huggingface.co/u/Angelina067)\
**Post date:** [July 15, 2025, 4:52am UTC](https://discuss.huggingface.co/t/api-access-always-returns-401-invalid-credentials/162805/3 "2025-07-15T04:52:11Z")

</div>

This is actually a common problem with a simple fix. The most likely cause is the Authorization header format.

To resolve it make sure your API call uses this exact format:

```auto
Authorization: Bearer hf_your_token_here

```

(Note: “Bearer” with a space after it, then your token)

If that doesn’t work, then do a little effort and try this:

1. Create one fresh token with just “READ” permissions
2. Copy it carefully (no extra spaces)
3. Test with this curl command:

bash

```auto
curl -H "Authorization: Bearer YOUR_NEW_TOKEN" https://huggingface.co/api/whoami

```

Most users solve it with the header format fix. If it still doesn’t work after trying a new token, it might be an account setting that Hugging Face support can quickly resolve.