API authentication errors
Your integration receives 401 Unauthorized, 403 Forbidden, or opaque auth errors when calling Dailybot APIs. Tokens expire, scopes shrink, and headers must match the documented scheme. Treat status codes literally: 401 means the credential is not accepted; 403 means the credential is valid but not allowed to do that action.
Quick check
- Authorization header — Send
Bearer <token>(or the documented scheme) exactly, without stray quotes or newlines copied from chat. - Clock — Sync server time; JWT validation fails on skewed systems.
- Token age — Rotate API keys on schedule and after people leave the team.
- Environment — Confirm you target production vs staging base URLs consistently with the token issued for that environment.
- Encoding — Avoid double-encoding query parameters that carry tokens in rare legacy paths.
Common causes and fixes
401: invalid or expired token
Regenerate the API key or OAuth access token in Dailybot, update your secret store, and redeploy the consuming service. If you cache tokens, bust the cache. For JWTs, decode (without trusting unverified claims for security decisions) to see exp and confirm renewal logic runs before expiry. Long-running daemons should refresh on 401 once to avoid storms, then alert if refresh fails.
403: insufficient scope
A valid token may lack the scope for the endpoint you added last sprint. Review the API reference for required scopes, re-authorize if OAuth-based, or create a key with broader permissions if your security model allows. Principle of least privilege is good, but too-tight keys waste hours. Separate read vs write integrations when possible.
Token rotation without rolling update
Blue/green deploys sometimes leave old pods holding old secrets. Ensure configuration reload propagates to every instance. For Kubernetes, restart Deployments after Secret changes if your chart does not auto-watch.
Wrong organization context
Keys are tied to an organization. Hitting another org’s resource IDs with the right cryptographic token still returns forbidden. Verify X-Org headers or path prefixes if the API uses them.
Revoked user account
If the token belonged to a deactivated user on an OAuth-style flow, authorization may persist briefly then fail. Reinstall the integration as a service account pattern or a dedicated bot user your policy supports.
If none of this worked
Before contacting support, gather:
- Endpoint path (no secrets) and HTTP method
- Status code and response body message (redact tokens)
- Approximate request time with timezone
- Whether the issue started after a deploy or key rotation
- Language/runtime of your client
- Steps you already tried from this article
Then contact Dailybot support from the Help or Contact options in the product or on the website.