# API access always returns 401 Invalid credentials
**URL:**
**Author:**  [@topdev21](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Fu%2Ftopdev21)%5C
**Post date:** [July 13, 2025, 2:59am UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Fapi-access-always-returns-401-invalid-credentials%2F162805%2F1 "2025-07-13T02:59:38Z")
Hello, I recently created a Hugging Face account and verified my email. I have generated multiple access tokens with read permissions, but every attempt to call the API endpoint [https://huggingface.co/api/whoami](https://huggingface.co/api/whoami) fails with:
{“error”:“Invalid credentials in Authorization header”}
I’ve tried:
- Multiple tokens
- Logging out and logging back in
- Deleting cookies and trying from incognito mode
- Verifying that the token is active
- Using curl and Python requests
But nothing works. Could you check if my account has an API restriction or if something else is wrong?
Thank you.
---
**Author:**  [@John6666](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Fu%2FJohn6666)%5C
**Post date:** [July 13, 2025, 4:05am UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Fapi-access-always-returns-401-invalid-credentials%2F162805%2F2 "2025-07-13T04:05:24Z")
Try [https://huggingface.co/api/whoami-v2](https://huggingface.co/api/whoami-v2)
[Hub API Endpoints](https://huggingface.co/docs/hub/api#get-apiwhoami-v2)
---
**Author:**  [@Angelina067](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Fu%2FAngelina067)%5C
**Post date:** [July 15, 2025, 4:52am UTC](/static-proxy?url=https%3A%2F%2Fdiscuss.huggingface.co%2Ft%2Fapi-access-always-returns-401-invalid-credentials%2F162805%2F3 "2025-07-15T04:52:11Z")
This is actually a common problem with a simple fix. The most likely cause is the Authorization header format.
To resolve it make sure your API call uses this exact format:
```auto
Authorization: Bearer hf_your_token_here
```
(Note: “Bearer” with a space after it, then your token)
If that doesn’t work, then do a little effort and try this:
1. Create one fresh token with just “READ” permissions
2. Copy it carefully (no extra spaces)
3. Test with this curl command:
bash
```auto
curl -H "Authorization: Bearer YOUR_NEW_TOKEN" https://huggingface.co/api/whoami
```
Most users solve it with the header format fix. If it still doesn’t work after trying a new token, it might be an account setting that Hugging Face support can quickly resolve.