API authentication errors

An API authentication error occurs when an application or client cannot prove that it is authorized to access an API resource. The exact authentication mechanism varies by DotwebApps product, so troubleshooting should focus on the environment, account state, connectivity, and documented configuration rather than on guessed token or endpoint details.

Common symptoms #

You may see messages such as:

• unauthorized
• forbidden
• authentication failed
• access denied
• expired session or authentication state
• API request rejected

Possible causes #

Broad causes may include:

• required authentication information is missing
• the current authentication state is invalid or expired
• the application is using the wrong environment or server
• API or authentication configuration does not match the product documentation
• the user or account does not have the required permission
• a web or mobile client is pointing to the wrong API environment
• a stale login or session state is being reused
• the API or backend server is unavailable
• a recent server move, update, or configuration change affected authentication

Safe diagnostic process #

1. Confirm that the application is using the correct environment and API for the intended deployment.
2. Verify that the user or account is valid and has the permissions required for the action.
3. Sign out and sign back in where appropriate to refresh the normal application session.
4. Review the API and authentication setup documented for the specific DotwebApps product.
5. Record the exact HTTP status or application error message with sensitive information removed.
6. Confirm that the application can reach the backend/API server.
7. Check whether the issue affects every user or only one account.
8. Check whether the problem began after an update, server migration, deployment, or configuration change.
9. Review relevant application or server logs privately, removing secrets before sharing them.
10. Contact DotwebApps support if the issue remains unresolved.

Keep authentication information private #

Do not post API keys, tokens, authorization values, private keys, OAuth secrets, passwords, or other authentication material in public messages, screenshots, logs, or support tickets.

When contacting support, provide the product name, affected environment, action that fails, user/account context where relevant, the sanitized error message, and what changed before the issue began. Do not send full source code or unrelated customer data.

Avoid implementation assumptions #

DotwebApps products may use different authentication methods. Do not assume a universal token format, refresh process, private endpoint, request header, login route, or internal authentication architecture unless the product documentation explicitly provides it.