🐛 Bug Report: API key authentication does not work #210

New Issue

OVERLORD · 2026-02-04T18:00:55+03:00

OVERLORD commented

2026-02-04 18:00:55 +03:00

Originally created by @jonasclaes on GitHub (Mar 15, 2025).

Reproduction steps

Create a new API key
Try to fetch some data from the API using the X-API-KEY header

Expected behavior

A response with the requested resources is returned.

Actual Behavior

The following error is returned from the backend.

{
    "error": "You are not signed in"
}

Version and Environment

v0.40.0
Caddy, outside of the container

I've investigated in the source, I think I know where the issue is coming from.

When passing an Authorization header with the contents as Bearer xyz, where xyz is a valid token used in the frontend, the authentication to the API succeeds.
When trying with the X-API-KEY, and the value set to the generated API key, the auth fails.

The logic in the auth_middleware.go file seems correct to me, however, the JWT auth function comes first, and I think these lines may cause the request to fail, even if the API key is correct? 348192b9d7/backend/internal/middleware/jwt_auth.go (L25-L26)
I'm assuming the issue is right there, however, I'm not sure how we could easily fix that without refactoring the auth middleware.

Log Output

Error #01: You are not signed in

Originally created by @jonasclaes on GitHub (Mar 15, 2025). ### Reproduction steps 1. Create a new API key 2. Try to fetch some data from the API using the `X-API-KEY` header ### Expected behavior A response with the requested resources is returned. ### Actual Behavior The following error is returned from the backend. ``` { "error": "You are not signed in" } ``` ### Version and Environment v0.40.0 Caddy, outside of the container I've investigated in the source, I think I know where the issue is coming from. When passing an `Authorization` header with the contents as `Bearer xyz`, where xyz is a valid token used in the frontend, the authentication to the API succeeds. When trying with the `X-API-KEY`, and the value set to the generated API key, the auth fails. The logic in the `auth_middleware.go` file seems correct to me, however, the JWT auth function comes first, and I think these lines may cause the request to fail, even if the API key is correct? https://github.com/pocket-id/pocket-id/blob/348192b9d7e2698add97810f8fba53d13d0df018/backend/internal/middleware/jwt_auth.go#L25-L26 I'm assuming the issue is right there, however, I'm not sure how we could easily fix that without refactoring the auth middleware. ### Log Output `Error #01: You are not signed in`

OVERLORD added the bug label 2026-02-04 18:00:55 +03:00

OVERLORD closed this issue

2026-02-04 18:00:56 +03:00

OVERLORD commented

2026-02-04 18:01:06 +03:00

@kmendell commented on GitHub (Mar 15, 2025):

I think this is oversight on the Auth header, ill take a look at this and see if i can find a fix for it.

@kmendell commented on GitHub (Mar 15, 2025): I think this is oversight on the Auth header, ill take a look at this and see if i can find a fix for it.

OVERLORD commented

2026-02-04 18:01:13 +03:00

@stonith404 commented on GitHub (Mar 16, 2025):

Fixed in v0.40.1.

@stonith404 commented on GitHub (Mar 16, 2025): Fixed in `v0.40.1`.

OVERLORD commented

2026-02-04 18:01:15 +03:00

@jonasclaes commented on GitHub (Mar 16, 2025):

Thanks for the quick fix guys! :D

@jonasclaes commented on GitHub (Mar 16, 2025): Thanks for the quick fix guys! :D

OVERLORD referenced this issue

2026-02-04 20:47:05 +03:00