API errors

unauthorized

The request carried no usable credentials: the bearer token is missing, invalid or expired, or the client credentials were rejected.

401application/problem+json

What it means

Every endpoint except POST /auth/token requires an Authorization: Bearer {token} header. This code means that header was missing, the token did not check out, or the token has expired. On POST /auth/token it means the client_id and client_secret were rejected.

Tokens are valid for 24 hours from issue.

401 · application/problem+json

{
  "type": "https://developers.firsty.app/errors/unauthorized",
  "title": "Unauthorized",
  "status": 401,
  "detail": "Invalid client credentials",
  "code": "unauthorized"
}

How to handle it

Request a fresh token from POST /auth/token and retry the original request once with it.
Cache a token for its lifetime instead of requesting one per call, and refresh it shortly before expiry.
Check you are sending the right environment's credentials. Sandbox and production credentials are separate, and each works only against its own base URL.
Do not loop on this error. If a freshly issued token is rejected, the credentials themselves are the problem; contact Firsty support.

Errors reference