# GET returning an error 401

**URL:** <https://devforum.okta.com/t/get-returning-an-error-401/23270>\
**Category:** API\
**Created:** [February 6, 2023, 8:09pm UTC](https://devforum.okta.com/t/get-returning-an-error-401/23270 "2023-02-06T20:09:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![JohnIGonza](https://avatars.discourse-cdn.com/v4/letter/j/e36b37/32.png) [@JohnIGonza](https://devforum.okta.com/u/JohnIGonza)\
**Post date:** [February 6, 2023, 8:09pm UTC](https://devforum.okta.com/t/get-returning-an-error-401/23270/1 "2023-02-06T20:09:59Z")

</div>

So here’s my code

async function getProfile() {  
const accessToken = “{REMOVED FOR SECURITY}”;  
const response = await fetch(‘[https://portal.hawxservices.com/api/v1/users/me](https://portal.hawxservices.com/api/v1/users/me)’, {  
headers: {  
Authorization: `Bearer ${accessToken}`,  
Accept: ‘application/json’  
}  
});

```
                    const user = await response.json();
                    const firstName = user.profile.firstName;
                    const lastName = user.profile.lastName;
                    const email = user.profile.email;
                    const phone = user.profile.mobilePhone || 'N/A';

                    console.log({ firstName, lastName, email, phone });
                }

```

getProfile();

the issue is when I run this I get an error 401(unathorized) from Okta, so I am running this off of local host and have it set to a trust url already. any idea on why this is happeing? Thanks!

I also have this code run when there is already an active user session.

---

<div class="post-metadata">

**Author:** ![JohnIGonza](https://avatars.discourse-cdn.com/v4/letter/j/e36b37/32.png) [@JohnIGonza](https://devforum.okta.com/u/JohnIGonza)\
**Post date:** [February 6, 2023, 8:37pm UTC](https://devforum.okta.com/t/get-returning-an-error-401/23270/2 "2023-02-06T20:37:40Z")

</div>

UPDATE: So as it turns out with this GET you actually put “SSWS” in place of “Bearer” along with the apitoken

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 7, 2023, 12:16am UTC](https://devforum.okta.com/t/get-returning-an-error-401/23270/3 "2023-02-07T00:16:53Z")

</div>

I do want to note that you can use Bearer {accessToken} in the auth header for this request. Using an SSWS token is good if the admin needs to make the call, but end-users can also use this endpoint

In order to get a token that you can use against this endpoint, the token will…

1. need to be returned by the Org Authorization server (e.g. [https://oktadomain/oauth2/v1/authorize](https://oktadomain/oauth2/v1/authorize))
2. contain the necessary scope, in this case `okta.users.read.self`
3. be issued to the user you want to get information about.

For more info, see [Implement OAuth for Okta | Okta Developer](https://developer.okta.com/docs/guides/implement-oauth-for-okta/main/)

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 13, 2024, 6:58pm UTC](https://devforum.okta.com/t/get-returning-an-error-401/23270/4 "2024-02-13T18:58:17Z")

</div>