# Device API Authentication request for receving JWT token always throwing 401 error **URL:** \ **Category:** General Discussions\ **Tags:** api, management-api\ **Created:** [January 8, 2024, 5:29am UTC](https://hub.mender.io/t/device-api-authentication-request-for-receving-jwt-token-always-throwing-401-error/6442 "2024-01-08T05:29:47Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![vimoxshah](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/vimoxshah/32/2406_2.png) [@vimoxshah](https://hub.mender.io/u/vimoxshah)\ **Post date:** [January 8, 2024, 5:29am UTC](https://hub.mender.io/t/device-api-authentication-request-for-receving-jwt-token-always-throwing-401-error/6442/1 "2024-01-08T05:29:47Z")
I wanted to check Device APIs and when I tried auth\_request api for getting JWT token for a device, I am always getting the 401 unauthorized error. It would be great If I can get any help. ```auto curl --location 'https://hosted.mender.io/api/devices/v1/authentication/auth_requests'; \ --header 'X-MEN-Signature: RSA' \ --header 'Content-Type: application/json' \ --data '{ "id_data": "{\"mac\":\"2c:6d:c1:6b:46:da\"}", "pubkey": "-----BEGIN PUBLIC KEY-----\nMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAs3RWHybSSrmEA9OspDj1\nhqmUD/+mey7QIhvJYBmmpxAmgLgEJEOkkTTER4jum19ejPquD/WU4IhPky8T8Zsb\nbWI6uKYHiKgHKRBscjr1l4rLgkPBVLpN25MXSXsNbTSzRt5BoJPRhDedaMACcuWv\nu0It67WL0NK60JQK3dJT4OxvxDzilVhnP/BTgUZcMdaAPk0NJIU7L+pAVLrTkuBT\njCVZN1lGSgv0p0+bzvUVDo8MNAJUnnyUTtrvgF4JlmAtoZIfr3f9Hy9MpZDwFv76\nH00MdcFEIZo5/2MzIRnufD0U4ZSMlk0AtD2sR0g75wDQQu6NqP5OmEMU3pGiTxeu\nDRGe1zR9bbip8jnbCZtBwvou0+uQuzDU80T4nYF/dIsk059HaE/Mx/ETgOEKYyz6\nZ3KkEIn4SLt8ljDBegdgeB69vTqblWdaIdLSWskpgh1RWYDQ1hE0yxzyiz1ya4S8\nurTqExRo9WvtOAvgmo9CX0LC2PR79ttqrQo96mJt24tjAgAE=\n-----END PUBLIC KEY-----\n", "tenant_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6MCwidHlwIjoiSldUIn0.eyJqdGkiOiI2ZGM1MGYxYy1lYmU0LTQ0ZjMtODhlNS0xNjNmZmE0ZWNjZWUiLCJzdWIiOiI0YTQ5NTUxMi0zZWJhLTQzMmItYjA5My1lNDUzMjk3NDc0MmMiLCJpYXQiOjE3MDQzNDM5MTQsIm1lbmRlci50ZW5hbnQiOiI2NTY2ZDZjNTVhZGIwYWVlYjg1NmEyZmYiLCJtZW5kZXIudXNlciI6dHJ1ZSwiaXNzIjoiTWVuZGVyIFVzZXJzIiwic2NwIjoibWVuZGVyLioiLCJtZW5kZXIucGxhbiI6ImVudGVycHJpc2UiLCJtZW5kZXIudHJpYWwiOnRydWUsIm1lbmRlci5hZGRvbnMiOlt7Im5hbWUiOiJjb25maWd1cmUiLCJlbmFibGVkIjp0cnVlfSx7Im5hbWUiOiJ0cm91Ymxlc2hvb3QiLCJlbmFibGVkIjp0cnVlfSx7Im5hbWUiOiJtb25pdG9yIiwiZW5hYmxlZCI6dHJ1ZX1dLCJuYmYiOjE3MDQzNDM5MTR9.JHVmxoR_HOrjvidH2xQuxZ3HhR28FstCFlDwdAmzJOPz3PgeIAHOd6RBFd6wKbQPRv-TXmmLrmQafVaqlPUCbVA6O-qW87MVv8DrLIJ383huKW0pJcSNkGLIPgyGGeTHNPfPd6nsG8vylRs6dVAHn8ts99Ffdt-G5OydtlSa4ABHTzUoUf_vGg2L2P62a5l1L1-e8ijbjLZ5bbGZPxmabju2QjnNSNB2E3jVD5wfmHcWdQuWCvJoELXkWzCYySsmdRiP7nbKkwopZz8g5lWjGZnoTtgWWCjGNT26L80Pa9vAn0tgg-LQFPSdrkFFxohAoKgGrk4QKh6lDdliQUaXX91oJfing_eyj5H78En-1AYJ20RpDSGU8xPV_f1MYILLwmGZ6AYZG1ZIKbs4inh2J_7srT4ziJv03NZWWkuFp5ybpKrQTFWagNxDb9NC8OqRv_NdBGn4DkRfV-VW2KRq-UejdF-BouB4oh-VLoxyAEzPwY1kHI6" }' ``` PS. I have not added correct keys so don’t worry. ---
**Author:** ![TheYoctoJester](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/theyoctojester/32/1444_2.png) [@TheYoctoJester](https://hub.mender.io/u/TheYoctoJester)\ **Post date:** [January 9, 2024, 8:30am UTC](https://hub.mender.io/t/device-api-authentication-request-for-receving-jwt-token-always-throwing-401-error/6442/2 "2024-01-09T08:30:39Z")
Hi @vimoxshah, According to the tutorial here, the `X-MEN-Signature` needs to be derived from a key pair: [How to write a custom client interfacing a Mender server](https://hub.mender.io/t/how-to-write-a-custom-client-interfacing-a-mender-server/1353#step-1-authentication-6) Greetz, Josef ---
**Author:** ![vimoxshah](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/vimoxshah/32/2406_2.png) [@vimoxshah](https://hub.mender.io/u/vimoxshah)\ **Post date:** [January 9, 2024, 2:35pm UTC](https://hub.mender.io/t/device-api-authentication-request-for-receving-jwt-token-always-throwing-401-error/6442/3 "2024-01-09T14:35:45Z")
@TheYoctoJester Thanks for your reply. How can I get Private key of the device? I can see public key on hosted mender. ---
**Author:** ![TheYoctoJester](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/theyoctojester/32/1444_2.png) [@TheYoctoJester](https://hub.mender.io/u/TheYoctoJester)\ **Post date:** [January 9, 2024, 4:06pm UTC](https://hub.mender.io/t/device-api-authentication-request-for-receving-jwt-token-always-throwing-401-error/6442/4 "2024-01-09T16:06:02Z")
@vimoxshah As the given tutorial describes, you need create a key pair yourself: [How to write a custom client interfacing a Mender server](https://hub.mender.io/t/how-to-write-a-custom-client-interfacing-a-mender-server/1353#step-1-authentication-6) Greetz, Josef ---
**Author:** ![vimoxshah](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/vimoxshah/32/2406_2.png) [@vimoxshah](https://hub.mender.io/u/vimoxshah)\ **Post date:** [January 10, 2024, 6:37am UTC](https://hub.mender.io/t/device-api-authentication-request-for-receving-jwt-token-always-throwing-401-error/6442/5 "2024-01-10T06:37:03Z")
@TheYoctoJester To ensure proper functionality, is it imperative for the device status to be in a pending state? Is there a possibility of utilizing the public key of an accepted device in the API request? In case this isn’t feasible, as outlined in the tutorial, are we required to generate a new set of private and public keys, and should the resulting public key be employed exclusively for X-MEN-Signature purposes or also embedded in the device? ---
**Author:** ![TheYoctoJester](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/theyoctojester/32/1444_2.png) [@TheYoctoJester](https://hub.mender.io/u/TheYoctoJester)\ **Post date:** [January 10, 2024, 10:40am UTC](https://hub.mender.io/t/device-api-authentication-request-for-receving-jwt-token-always-throwing-401-error/6442/6 "2024-01-10T10:40:14Z")
Hi @vimoxshah, Maybe there is a misunderstanding here. The flow is like that: 1. you generate a per-device key pair, and use that to call `auth_request` 2. this returns `unauthorised`, and places the device in “Pending” state on the management interface 3. you accept the device in the management interface. The public key is displayed for verification here. 4. upon the next call to `auth_request`, the JWT token is returned. Greets, Josef ---
**Author:** ![vimoxshah](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/vimoxshah/32/2406_2.png) [@vimoxshah](https://hub.mender.io/u/vimoxshah)\ **Post date:** [January 10, 2024, 10:55am UTC](https://hub.mender.io/t/device-api-authentication-request-for-receving-jwt-token-always-throwing-401-error/6442/7 "2024-01-10T10:55:03Z")
@TheYoctoJester Thanks for sharing the flow. So once I generate the key pair and call the auth\_request which returns the unauthorized then it will create a new device in a pending state and will be showing on the management interface. Is this understanding correct? ---
**Author:** ![TheYoctoJester](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/theyoctojester/32/1444_2.png) [@TheYoctoJester](https://hub.mender.io/u/TheYoctoJester)\ **Post date:** [January 10, 2024, 10:59am UTC](https://hub.mender.io/t/device-api-authentication-request-for-receving-jwt-token-always-throwing-401-error/6442/8 "2024-01-10T10:59:47Z")
@vimoxshah that is correct, yes. Greets, Josef ---
**Author:** ![vimoxshah](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/vimoxshah/32/2406_2.png) [@vimoxshah](https://hub.mender.io/u/vimoxshah)\ **Post date:** [January 10, 2024, 11:14am UTC](https://hub.mender.io/t/device-api-authentication-request-for-receving-jwt-token-always-throwing-401-error/6442/9 "2024-01-10T11:14:36Z")
@TheYoctoJester I’ve tried to create a new key pair and called auth\_request API and received unauthorized error which is expected. but I can’t see any new pending device on our interface? what could be the reason? ---
**Author:** ![vimoxshah](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/vimoxshah/32/2406_2.png) [@vimoxshah](https://hub.mender.io/u/vimoxshah)\ **Post date:** [January 11, 2024, 11:53am UTC](https://hub.mender.io/t/device-api-authentication-request-for-receving-jwt-token-always-throwing-401-error/6442/10 "2024-01-11T11:53:25Z")
@TheYoctoJester As mentioned earlier I’ve tried to create a new key pair and called auth\_request API and received unauthorized error which is expected. but I can’t see any new pending device on our interface? Can you please help what am I missing? ---
**Author:** ![TheYoctoJester](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/theyoctojester/32/1444_2.png) [@TheYoctoJester](https://hub.mender.io/u/TheYoctoJester)\ **Post date:** [January 11, 2024, 12:00pm UTC](https://hub.mender.io/t/device-api-authentication-request-for-receving-jwt-token-always-throwing-401-error/6442/11 "2024-01-11T12:00:46Z")
Hi @vimoxshah, From the outside it’s hard to tell, so you have to go digging yourself now. A few places to start: - if it is a self-hosted instance: look at the logs - can you connect a device running the original Mender Client? - what is the actual reason for replicating the authentication? Greets, Josef ---
**Author:** ![vimoxshah](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/vimoxshah/32/2406_2.png) [@vimoxshah](https://hub.mender.io/u/vimoxshah)\ **Post date:** [January 11, 2024, 12:43pm UTC](https://hub.mender.io/t/device-api-authentication-request-for-receving-jwt-token-always-throwing-401-error/6442/12 "2024-01-11T12:43:02Z")
@TheYoctoJester actually we want to make device provisioning feature from our product but behind the scene we would like to use mender for OTA etc. so when end user actually confirm the device on our UI then only we would like to accept device on mender side also we would like to set few attributes for a device on mender side so we can distinguish it for each customers. so using device apis are really helpful for us. but we stuck on device auth at this moment. hope you get the idea of our requirements. ---
**Author:** ![TheYoctoJester](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/theyoctojester/32/1444_2.png) [@TheYoctoJester](https://hub.mender.io/u/TheYoctoJester)\ **Post date:** [January 11, 2024, 12:53pm UTC](https://hub.mender.io/t/device-api-authentication-request-for-receving-jwt-token-always-throwing-401-error/6442/13 "2024-01-11T12:53:05Z")
@vimoxshah to be honest, I don’t understand it, sorry. What you’re describing is a whole different flow to me: 1. the device runs Mender Client and requests authentication to the Mender Server 2. the server puts the device into pending state 3. the device is accepted. This can either be done through the web dashboard - or your custom logic, calling the device auth endpoint: [Mender API docs](https://docs.mender.io/api/#management-api-device-authentication-set-authentication-status) 4. PROFIT. For specific device customisation, you can either set tags per device through the API (server-side), or use the configure AddOn to push configuration items to the device: [Configure | Mender documentation](https://docs.mender.io/add-ons/configure) Greets, Josef ---
**Author:** ![vimoxshah](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/vimoxshah/32/2406_2.png) [@vimoxshah](https://hub.mender.io/u/vimoxshah)\ **Post date:** [January 11, 2024, 12:54pm UTC](https://hub.mender.io/t/device-api-authentication-request-for-receving-jwt-token-always-throwing-401-error/6442/14 "2024-01-11T12:54:48Z")
@TheYoctoJester We can use tags but management api do not return tags in api response. ---
**Author:** ![TheYoctoJester](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/theyoctojester/32/1444_2.png) [@TheYoctoJester](https://hub.mender.io/u/TheYoctoJester)\ **Post date:** [January 11, 2024, 1:08pm UTC](https://hub.mender.io/t/device-api-authentication-request-for-receving-jwt-token-always-throwing-401-error/6442/15 "2024-01-11T13:08:05Z")
@vimoxshah the device inventory endpoints ([Mender API docs](https://docs.mender.io/api/#management-api-device-inventory-list-device-inventories)) do include the tags, so I still fail to understand the problem. The only reason I can see for reimplementing the `auth_requests` call is to write a custom client implementation - and as you stated not doing that, I just have to guess that something in your reasoning is either off, or you are not sharing an essential piece of information required to understand the problem. Greets, Josef ---
**Author:** ![vimoxshah](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/vimoxshah/32/2406_2.png) [@vimoxshah](https://hub.mender.io/u/vimoxshah)\ **Post date:** [January 11, 2024, 1:16pm UTC](https://hub.mender.io/t/device-api-authentication-request-for-receving-jwt-token-always-throwing-401-error/6442/16 "2024-01-11T13:16:14Z")
@TheYoctoJester Simply I would like to set few fields in scope of device identity using APIs. To achieve this I require device JWT. Let me know how can I achieve it. I got your point that device inventory endpoint provide the details all scopes tags, inventory. but I don’t want to use tags for few important fields. If you can provide tags data in [List devices](https://docs.mender.io/api/#management-api-device-authentication-list-devices) this endpoint then it would be great. ---
**Author:** ![TheYoctoJester](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/theyoctojester/32/1444_2.png) [@TheYoctoJester](https://hub.mender.io/u/TheYoctoJester)\ **Post date:** [January 11, 2024, 1:22pm UTC](https://hub.mender.io/t/device-api-authentication-request-for-receving-jwt-token-always-throwing-401-error/6442/17 "2024-01-11T13:22:18Z")
@vimoxshah sorry, but that reasoning is off. Fields in the device inventory are set as either tags, or from the device itself during an inventory update. To add things from the device see [Inventory | Mender documentation](https://docs.mender.io/client-installation/inventory#basic-rules-for-inventory-attributes) The endpoint for adding tags I have already given. You also would not use a per device JWT for that, but a personal access token as described here: [Using the APIs | Mender documentation](https://docs.mender.io/server-integration/using-the-apis#personal-access-tokens). Greets, Josef ---
**Author:** ![TheYoctoJester](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/theyoctojester/32/1444_2.png) [@TheYoctoJester](https://hub.mender.io/u/TheYoctoJester)\ **Post date:** [January 11, 2024, 1:30pm UTC](https://hub.mender.io/t/device-api-authentication-request-for-receving-jwt-token-always-throwing-401-error/6442/18 "2024-01-11T13:30:33Z")
We’re getting closer, I think. So you’re trying to get a list of devices based on some information. How about using inventory filters and search? [Mender API docs](https://docs.mender.io/api/#management-api-device-inventory-filters-and-search-search-device-inventories) Greets, Josef ---
**Author:** ![vimoxshah](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/vimoxshah/32/2406_2.png) [@vimoxshah](https://hub.mender.io/u/vimoxshah)\ **Post date:** [January 11, 2024, 1:34pm UTC](https://hub.mender.io/t/device-api-authentication-request-for-receving-jwt-token-always-throwing-401-error/6442/19 "2024-01-11T13:34:12Z")
@TheYoctoJester That’s true. I am trying filter and search API but API is responding with empty result. I’ve created tags but do not know why result is coming as empty array ---
**Author:** ![TheYoctoJester](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/theyoctojester/32/1444_2.png) [@TheYoctoJester](https://hub.mender.io/u/TheYoctoJester)\ **Post date:** [January 11, 2024, 1:36pm UTC](https://hub.mender.io/t/device-api-authentication-request-for-receving-jwt-token-always-throwing-401-error/6442/20 "2024-01-11T13:36:03Z")
Progress then. Again, what kind of instance is this? Self-hosted OSS? How does your filter look like? Greets, Josef [Next page](https://hub.mender.io/t/device-api-authentication-request-for-receving-jwt-token-always-throwing-401-error/6442.md?page=2)