# Unauthorized Access Token

**URL:** <https://discuss.huggingface.co/t/unauthorized-access-token/160609>\
**Category:** Beginners\
**Created:** [June 25, 2025, 9:01am UTC](https://discuss.huggingface.co/t/unauthorized-access-token/160609 "2025-06-25T09:01:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![FreeRoss](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/freeross/32/50057_2.png) [@FreeRoss](https://discuss.huggingface.co/u/FreeRoss)\
**Post date:** [June 25, 2025, 9:01am UTC](https://discuss.huggingface.co/t/unauthorized-access-token/160609/1 "2025-06-25T09:01:15Z")

</div>

Hi,

Thanks in advance if you’re able to help out.

- **All** the code that leads to the problem:

```auto
curl -H "Authorization: Bearer hf_<...>bfQ" https://huggingface.co/api/whoami

```

- The **full error message** :

```auto
{"error":"Invalid credentials in Authorization header"}

```

- Provide the version of the library you are using:  
I’m not using a library for this

- If you have tried something in particular to solve your problem, don’t hesitate to mention it as well:  
I tried to use the credentials initially in an n8n workflow → http request node. The curl is the simplest way to express this problem.  
Please find attached shot of the tokens I setup:  

The error message is clear as to what the problem is (unauthorized). What I do not know is why and/or why Huggingface server interprets the access token as anauthorized?

---

<div class="post-metadata">

**Author:** ![John6666](https://sea2.discourse-cdn.com/hellohellohello/user_avatar/discuss.huggingface.co/john6666/32/27664_2.png) [@John6666](https://discuss.huggingface.co/u/John6666)\
**Post date:** [June 25, 2025, 10:22am UTC](https://discuss.huggingface.co/t/unauthorized-access-token/160609/2 "2025-06-25T10:22:46Z")

</div>

Try v2.

```py
HF_TOKEN = "hf_foobar"
import subprocess
subprocess.run(f'curl -H "Authorization: Bearer {HF_TOKEN}" https://huggingface.co/api/whoami', shell=True)
# {"error":"Invalid credentials in Authorization header"}
subprocess.run(f'curl -H "Authorization: Bearer {HF_TOKEN}" https://huggingface.co/api/whoami-v2', shell=True)
# {"type":"user", ...

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/hellohellohello/original/2X/d/de4155eb4aa4108ecb32a1389d7cc37ae69f88b7.png) [@system](https://discuss.huggingface.co/u/system)\
**Post date:** [June 26, 2025, 5:47am UTC](https://discuss.huggingface.co/t/unauthorized-access-token/160609/3 "2025-06-26T05:47:53Z")

</div>

This topic was automatically closed 12 hours after the last reply. New replies are no longer allowed.