# \[SOLVED\] Authorization token usage clarification **URL:** \ **Category:** Troubleshooting\ **Created:** [August 12, 2016, 3:43pm UTC](https://forum.mattermost.com/t/solved-authorization-token-usage-clarification/2067 "2016-08-12T15:43:51Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Julia](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/julia/32/864_2.png) [@Julia](https://forum.mattermost.com/u/Julia)\ **Post date:** [August 12, 2016, 3:43pm UTC](https://forum.mattermost.com/t/solved-authorization-token-usage-clarification/2067/1 "2016-08-12T15:43:51Z")
I am working on native android using your github version as a base. I am trying to access a team’s channels but I am getting authorization errors. Token is obtained from the cookie I get from `/login`. I am temporarily just using `teemb` as my team, I will make it dynamic later after this works for sure, I have tried: * * * **Attempt 1** `@GET("/api/v3/teams/teemb/channels/") Promise getChannels(@Header("Authorization: Bearer TOKEN") String token);` with error: `{"status_code":401, "message":"Invalid or expired session, please login again.", "id":"api.context.session_expired.app_error", "is_oauth":false, "detailed_error":"token=TOKEN: xw1hjgourbn3d8mromd75i5qbe", "request_id":"kdgqmtp4itrsjdje13pr8jwiqr"}` * * * **Attempt 2** `@GET("/api/v3/teams/teemb/channels/") Promise getChannels(@Header("Authorization: Bearer") String token);` with error: `{"status_code":401, "message":"Invalid or expired session, please login again.", "id":"api.context.session_expired.app_error", "is_oauth":false, "detailed_error":"token= uhb5a8tt33rejp6qtrwtdhf8hy", "request_id":"5eerg4nttigybcmirx6u3q756o"}` * * * **Attempt 3** `@GET("/api/v3/teams/teemb/channels/") Promise getChannels(@Header("Authorization Bearer Token") String token);` with error: `{"status_code":500, "message":"Invalid or expired session, please login again.", "id":"api.context.session_expired.app_error", "is_oauth":false, "detailed_error":"token=xe8oza8z57gsxeh4b9rw3qhdoo Appears to bea CSRF attempt", "request_id":"pry8whe13py8zbhcgs6nr88qph"}` * * * **Attempt 4** `@GET("/api/v3/users/me") Promise getMe();` with error: ## `{"status_code":500, "message":"Invalid or expired session, please login again.", "id":"api.context.session_expired.app_error", "is_oauth":false, "detailed_error":"token=51nf7r71rfrxzfeog8go5jj16h Appears to bea CSRF attempt", "request_id":"heos31w83pn5mpxqrhna6qawbo"}` **Other notes** Getting the user works and returns the user I logged in as. `@GET("/api/v3/users/me") Promise getMe();` How exactly am I supposed to do this? ---
**Author:** ![hmhealey](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/hmhealey/32/1915_2.png) [@hmhealey](https://forum.mattermost.com/u/hmhealey)\ **Post date:** [August 12, 2016, 4:24pm UTC](https://forum.mattermost.com/t/solved-authorization-token-usage-clarification/2067/2 "2016-08-12T16:24:56Z")
Hi @Julia, The routes under `/teams` require the team’s ID, not its name. We’ve had a few people make the same mistake already, so I’ll make a note to make that more clear when we redo our API docs. ---
**Author:** ![Julia](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/julia/32/864_2.png) [@Julia](https://forum.mattermost.com/u/Julia)\ **Post date:** [August 12, 2016, 5:08pm UTC](https://forum.mattermost.com/t/solved-authorization-token-usage-clarification/2067/3 "2016-08-12T17:08:47Z")
I tried them with the IDs instead, still same errors, were any of my attempts correct for authorization? ---
**Author:** ![elias](https://avatars.discourse-cdn.com/v4/letter/e/41988e/32.png) [@elias](https://forum.mattermost.com/u/elias)\ **Post date:** [August 12, 2016, 8:04pm UTC](https://forum.mattermost.com/t/solved-authorization-token-usage-clarification/2067/4 "2016-08-12T20:04:08Z")
Have you tried to use the Token that is return in the Header of the `login` response? ---
**Author:** ![Julia](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/julia/32/864_2.png) [@Julia](https://forum.mattermost.com/u/Julia)\ **Post date:** [August 15, 2016, 12:36pm UTC](https://forum.mattermost.com/t/solved-authorization-token-usage-clarification/2067/5 "2016-08-15T12:36:47Z")
That comes back as a cookie right? If so, then yes. ---
**Author:** ![elias](https://avatars.discourse-cdn.com/v4/letter/e/41988e/32.png) [@elias](https://forum.mattermost.com/u/elias)\ **Post date:** [August 15, 2016, 12:57pm UTC](https://forum.mattermost.com/t/solved-authorization-token-usage-clarification/2067/6 "2016-08-15T12:57:14Z")
So you’re setting the Authorizarion Header of the request like `Authorization: Bearer ` or `Authorization: Token ` that should work. ---
**Author:** ![Julia](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/julia/32/864_2.png) [@Julia](https://forum.mattermost.com/u/Julia)\ **Post date:** [August 15, 2016, 3:02pm UTC](https://forum.mattermost.com/t/solved-authorization-token-usage-clarification/2067/7 "2016-08-15T15:02:49Z")
I am trying that but I am getting error: `token= Appears to bea CSRF attempt` ---
**Author:** ![elias](https://avatars.discourse-cdn.com/v4/letter/e/41988e/32.png) [@elias](https://forum.mattermost.com/u/elias)\ **Post date:** [August 16, 2016, 1:15pm UTC](https://forum.mattermost.com/t/solved-authorization-token-usage-clarification/2067/8 "2016-08-16T13:15:19Z")
Hmm ok that means that you have to include another Header in the request which is `'X-Requested-With': 'XMLHttpRequest'`. that should solve your problem ---
**Author:** ![Julia](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/julia/32/864_2.png) [@Julia](https://forum.mattermost.com/u/Julia)\ **Post date:** [August 16, 2016, 1:46pm UTC](https://forum.mattermost.com/t/solved-authorization-token-usage-clarification/2067/9 "2016-08-16T13:46:25Z")
I am doing it like this but still getting the same error. ``` @Headers("X-Requested-With: XMLHttpRequest") @GET("/api/v3/teams/{teamID}/channels/") Promise getChannels( @Header("Authorization: Bearer ") String token, @Path("teamID") String tid); ``` ---
**Author:** ![Julia](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/julia/32/864_2.png) [@Julia](https://forum.mattermost.com/u/Julia)\ **Post date:** [August 16, 2016, 3:52pm UTC](https://forum.mattermost.com/t/solved-authorization-token-usage-clarification/2067/10 "2016-08-16T15:52:27Z")
I figured it out, it should be `@Header("Authorization") String token,` where `token = "Bearer " + numericalToken` instead of `@Header("Authorization: Bearer ") String token,` ---
**Author:** ![girish17](https://avatars.discourse-cdn.com/v4/letter/g/9f8e36/32.png) [@girish17](https://forum.mattermost.com/u/girish17)\ **Post date:** [November 13, 2019, 3:02pm UTC](https://forum.mattermost.com/t/solved-authorization-token-usage-clarification/2067/11 "2019-11-13T15:02:56Z")
Hello everyone, I am facing a similar issue. Can someone help? Request: `POST /api/v4/posts HTTP/1.1 Host: 192.168.1.6:8065 Content-Type: application/json Authorization: Bearer mchfahrf438ruqz81bq8ntuofy cache-control: no-cache Postman-Token: 48505faf-8ebe-4fba-bdc7-50927f7944cb { “channel\_id”: “n717dzbmm789f8r5xmrjqikx3y”, “message”: “Hello there…”, “props”: { “attachments”: [ { “pretext”: “Wassup?”, “text”: “sup” } ] } }` Response: `{"id":"api.context.session_expired.app_error","message":"Invalid or expired session, please login again.","detailed_error":"","request_id":"btojsoi3oj83fg1a5qgopcfpta","status_code":401}` ---
**Author:** ![niti2539](https://avatars.discourse-cdn.com/v4/letter/n/e36b37/32.png) [@niti2539](https://forum.mattermost.com/u/niti2539)\ **Post date:** [April 2, 2020, 7:03am UTC](https://forum.mattermost.com/t/solved-authorization-token-usage-clarification/2067/12 "2020-04-02T07:03:02Z")
this help me. Thank you !!!