# API error "invalid session"

**URL:** <https://devforum.okta.com/t/api-error-invalid-session/31866>\
**Category:** API\
**Created:** [February 3, 2025, 9:23pm UTC](https://devforum.okta.com/t/api-error-invalid-session/31866 "2025-02-03T21:23:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rhornsby](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/rhornsby/32/5846_2.png) [@rhornsby](https://devforum.okta.com/u/rhornsby)\
**Post date:** [February 3, 2025, 9:23pm UTC](https://devforum.okta.com/t/api-error-invalid-session/31866/1 "2025-02-03T21:23:23Z")

</div>

This has to be a stupid question, but I’m trying to use cURL to call the Okta API just as shown in the examples in the API docs[1]:

```auto
curl -i -X GET \
  https://subdomain.okta.com/api/v1/apps \
  -H 'Authorization: YOUR_API_KEY_HERE'

```

so, I naturally get:

```auto
╰─○ curl -X GET \
  "https://my_okta_domain.okta.com/api/v1/apps/" \
  -H "Authorization: $OKTA_API_TOKEN"

```

but it errors out `{"errorCode":"E0000005","errorSummary":"Invalid session","errorLink":"E0000005","errorId":"some-random-string-here","errorCauses":[]}`

The specific API call (in the example here, “list applications”) doesn’t seem to matter.

`$OKTA_API_TOKEN` is valid because Terraform uses it and can talk to Okta. I’ve seen some suggestions that the `Authorization` header value needs to contain the string (literal?) `SWSS` for some reason, but that doesn’t work either.

I’ve also tried to use the postman collection and am getting the same error. This can’t be that hard, I must be missing something obvious?

thanks

[1] [Applications](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Application/#tag/Application/operation/listApplications)

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 3, 2025, 9:26pm UTC](https://devforum.okta.com/t/api-error-invalid-session/31866/2 "2025-02-03T21:26:15Z")

</div>

if you are passing a [static API token](https://developer.okta.com/docs/guides/create-an-api-token/main/#okta-api-tokens) generated in the admin UI (at Security → API → Tokens), then yes, your Authorization header value should be set to `SSWS YOUR_API_TOKEN`. (note that its SSWS not SWSS)

---

<div class="post-metadata">

**Author:** ![rhornsby](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/rhornsby/32/5846_2.png) [@rhornsby](https://devforum.okta.com/u/rhornsby)\
**Post date:** [February 3, 2025, 9:30pm UTC](https://devforum.okta.com/t/api-error-invalid-session/31866/3 "2025-02-03T21:30:29Z")

</div>

Thanks the prompt reply. You’re right, I needed to use `SSWS` in the `Authorization` header.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [February 4, 2025, 9:31pm UTC](https://devforum.okta.com/t/api-error-invalid-session/31866/4 "2025-02-04T21:31:08Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.