# INVALID\_AUTHENTICATION using API Key method **URL:** \ **Category:** APIs & Integrations\ **Tags:** starter\ **Created:** [March 23, 2021, 8:36pm UTC](https://community.hubspot.com/t/invalid-authentication-using-api-key-method/34407 "2021-03-23T20:36:02Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![VEspo](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/vespo/32/44503_2.png) [@VEspo](https://community.hubspot.com/u/VEspo)\ **Post date:** [March 23, 2021, 8:36pm UTC](https://community.hubspot.com/t/invalid-authentication-using-api-key-method/34407/1 "2021-03-23T20:36:02Z")
When I make this call from within Postman it works fine, but when I try to call it from my website I get the error at the bottom. Please advise why this would happen [https://api.hubapi.com/crm/v3/objects/contacts?hapikey=\?&limit=3&archived=false&properties=id,firstname,lastname,email](https://api.hubapi.com/crm/v3/objects/contacts?hapikey=a556974d-1403-425d-b4b1-f83be747c9eb&limit=3&archived=false&properties=id,firstname,lastname,email) 401{“status”:“error”,“message”:“Authentication credentials not found. This API supports both API Key and OAuth 2.0 authentication and you can find more details at [https://developers.hubspot.com/docs/methods/auth/oauth-overview",“correlationId”:“42b2380c-ebd3-422c-b41a-5c5fe1d36840”,“category”:"INVALID\_AUTHENTICATION](https://developers.hubspot.com/docs/methods/auth/oauth-overview%22,%22correlationId%22:%2242b2380c-ebd3-422c-b41a-5c5fe1d36840%22,%22category%22:%22INVALID_AUTHENTICATION)”} HubSpot Account 8835722 ---
**Author:** ![dennisedson](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/dennisedson/32/28044_2.png) [@dennisedson](https://community.hubspot.com/u/dennisedson)\ **Post date:** [March 24, 2021, 4:49pm UTC](https://community.hubspot.com/t/invalid-authentication-using-api-key-method/34407/2 "2021-03-24T16:49:31Z")
Hi @VEspo When you say from my website? Are you using this in the front end js? If so, I would highly recommend not doing that as you will expose the API key. If not, can you give us some more details about what you are doing? @malcolm1 might be able to help once we have some more info 😀 ---
**Author:** ![VEspo](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/vespo/32/44503_2.png) [@VEspo](https://community.hubspot.com/u/VEspo)\ **Post date:** [March 24, 2021, 6:04pm UTC](https://community.hubspot.com/t/invalid-authentication-using-api-key-method/34407/3 "2021-03-24T18:04:11Z")
I’m the programmer for a customer who has a paid HubSPot account with you. They have the bulk of their data in an SQL database which connects to the website and their backend admin. They want me to keep their database and their HubSpot data in sync with your APIs – so I am trying to call your contacts API via a winhttp call from their website. It’s in ASP – and they have SSL on the site .. the key is not exposed. We do this with GHIN/USGA, MemberPlanet, GolfGenius, and many others. The main goal is to add/update/search and create contacts, as well as pulling changes and getting a full list of the contact IDs to match up to their SQL records. Nothing else at this time. ---
**Author:** ![malcolm1](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/malcolm1/32/28756_2.png) [@malcolm1](https://community.hubspot.com/u/malcolm1)\ **Post date:** [March 24, 2021, 8:25pm UTC](https://community.hubspot.com/t/invalid-authentication-using-api-key-method/34407/4 "2021-03-24T20:25:53Z")
If it works in Postman then you have the right targets and the right data structures. Look at the way in which Postman is handling authentication and copy that into your winhttp call. By the way, do you know about Postman’s “copy as…” command? It generates the same call that you are making via Postman in dozens of different languages. off-topic: I sometimes which I could route the calls through my postman collection. It would be my secret power-tool. ---
**Author:** ![VEspo](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/vespo/32/44503_2.png) [@VEspo](https://community.hubspot.com/u/VEspo)\ **Post date:** [March 25, 2021, 4:45pm UTC](https://community.hubspot.com/t/invalid-authentication-using-api-key-method/34407/5 "2021-03-25T16:45:34Z")
Thanks Malcom -- Authoorization Type = No Auth. The only thing I see different in the Postman code is that it is sending thru a cookie in the request header - I’m not finding anything about that in the documentation or endpoints. ---
**Author:** ![VEspo](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/vespo/32/44503_2.png) [@VEspo](https://community.hubspot.com/u/VEspo)\ **Post date:** [March 25, 2021, 4:59pm UTC](https://community.hubspot.com/t/invalid-authentication-using-api-key-method/34407/6 "2021-03-25T16:59:37Z")
Actually - the cookie doesn’t do anything. I deleted it in Postman and it still ran. My code (outside of Postman) still gets a 401 Unauthorized response when I copy and paste from their code ---
**Author:** ![malcolm1](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/malcolm1/32/28756_2.png) [@malcolm1](https://community.hubspot.com/u/malcolm1)\ **Post date:** [March 25, 2021, 8:37pm UTC](https://community.hubspot.com/t/invalid-authentication-using-api-key-method/34407/7 "2021-03-25T20:37:14Z")
Aren’t you passing a Bearer token? ---
**Author:** ![VEspo](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/vespo/32/44503_2.png) [@VEspo](https://community.hubspot.com/u/VEspo)\ **Post date:** [March 26, 2021, 3:19pm UTC](https://community.hubspot.com/t/invalid-authentication-using-api-key-method/34407/8 "2021-03-26T15:19:04Z")
No - was using the API Key method -- same inside of Postman ---
**Author:** ![RMones](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/rmones/32/82797_2.png) [@RMones](https://community.hubspot.com/u/RMones)\ **Post date:** [March 29, 2021, 12:35pm UTC](https://community.hubspot.com/t/invalid-authentication-using-api-key-method/34407/9 "2021-03-29T12:35:56Z")
Are u sure the API is send with the request from your website? ---
**Author:** ![VEspo](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/vespo/32/44503_2.png) [@VEspo](https://community.hubspot.com/u/VEspo)\ **Post date:** [March 30, 2021, 5:33pm UTC](https://community.hubspot.com/t/invalid-authentication-using-api-key-method/34407/10 "2021-03-30T17:33:50Z")
Yes -- I’ve tried sending it from both my localhost and website -- get the same error record for both ---
**Author:** ![malcolm1](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/malcolm1/32/28756_2.png) [@malcolm1](https://community.hubspot.com/u/malcolm1)\ **Post date:** [March 30, 2021, 9:02pm UTC](https://community.hubspot.com/t/invalid-authentication-using-api-key-method/34407/11 "2021-03-30T21:02:49Z")
It’s working in Postman. Have you tried copying the working code using Postman’s “code” converter to see what you get? ---
**Author:** ![VEspo](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/vespo/32/44503_2.png) [@VEspo](https://community.hubspot.com/u/VEspo)\ **Post date:** [March 31, 2021, 6:17pm UTC](https://community.hubspot.com/t/invalid-authentication-using-api-key-method/34407/12 "2021-03-31T18:17:55Z")
I did. You can close this thread. I’m giving up on the API Key auths -- was able to get the oAuth working. Thanks! ---
**Author:** ![DSvilpa](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/dsvilpa/32/193694_2.png) [@DSvilpa](https://community.hubspot.com/u/DSvilpa)\ **Post date:** [February 26, 2022, 8:37pm UTC](https://community.hubspot.com/t/invalid-authentication-using-api-key-method/34407/13 "2022-02-26T20:37:52Z")
Hi Guys, I solve it pretty quickly. The issue is Hubspot documentation for API\_key is outdated, I assume because its a less secure method of authentification, especially if you send it through query parameters. I can confirm, for api\_key (not private app which uses auth2 auth), you need to use bearer authorisation, which does append it to the headers of the request. import requests endpoint = “…/api/ip” data = {“ip”: “1.1.2.3”} headers = {“Authorization”: “Bearer MYREALLYLONGTOKENIGOT”} print(requests.post(endpoint, data=data, headers=headers).json()) ---
**Author:** ![SKumar62](https://avatars.discourse-cdn.com/v4/letter/s/9de0a6/32.png) [@SKumar62](https://community.hubspot.com/u/SKumar62)\ **Post date:** [August 26, 2022, 4:49pm UTC](https://community.hubspot.com/t/invalid-authentication-using-api-key-method/34407/14 "2022-08-26T16:49:14Z")
The issue remains with Auth token also. Very disappointed.