API error "invalid session"

[rhornsby]

This has to be a stupid question, but I’m trying to use cURL to call the Okta API just as shown in the examples in the API docs[1]:

curl -i -X GET \
  https://subdomain.okta.com/api/v1/apps \
  -H 'Authorization: YOUR_API_KEY_HERE'

so, I naturally get:

╰─○ curl -X GET \
  "https://my_okta_domain.okta.com/api/v1/apps/" \
  -H "Authorization: $OKTA_API_TOKEN"

but it errors out {"errorCode":"E0000005","errorSummary":"Invalid session","errorLink":"E0000005","errorId":"some-random-string-here","errorCauses":[]}

The specific API call (in the example here, “list applications”) doesn’t seem to matter.

$OKTA_API_TOKEN is valid because Terraform uses it and can talk to Okta. I’ve seen some suggestions that the Authorization header value needs to contain the string (literal?) SWSS for some reason, but that doesn’t work either.

I’ve also tried to use the postman collection and am getting the same error. This can’t be that hard, I must be missing something obvious?

thanks

[1] Applications

[andrea]

if you are passing a static API token generated in the admin UI (at Security → API → Tokens), then yes, your Authorization header value should be set to SSWS YOUR_API_TOKEN. (note that its SSWS not SWSS)

[rhornsby]

Thanks the prompt reply. You’re right, I needed to use SSWS in the Authorization header.