# X-API-Auth failure: not authorized answer **URL:** \ **Category:** Help Hub\ **Tags:** authentication, json\ **Created:** [November 1, 2022, 12:01pm UTC](https://community.postman.com/t/x-api-auth-failure-not-authorized-answer/40666 "2022-11-01T12:01:40Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![adriano.ellero](https://avatars.discourse-cdn.com/v4/letter/a/5daacb/32.png) [@adriano.ellero](https://community.postman.com/u/adriano.ellero)\ **Post date:** [November 1, 2022, 12:01pm UTC](https://community.postman.com/t/x-api-auth-failure-not-authorized-answer/40666/1 "2022-11-01T12:01:40Z")
I have this instruction: API Key authentication Each API Key comes with an API Secret used to sign the messages you send. To authenticate, you must add to your request the header `X-API-Auth` containing the API Key and a message signature: So I added to the Header a Key named X-API-Auth, with value key split by comma and secret code as for example key\_xyz,secret\_abc _Details (like screenshots)_: ![image](https://us1.discourse-cdn.com/getpostman/original/3X/8/6/8696ef5701b676bf9d905e28c995bcc700bd9f6e.png) _How I found the problem_: the answer I got is ``` "timestamp": "2022-11-01T11:44:34.502+00:00", "status": 401, "error": "Unauthorized", "path": "/v1/devices" ``` _I’ve already tried_: to use inheriting-authorization, no auth, API key, but failing ---
**Author:** ![michaelderekjones](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/michaelderekjones/32/14819_2.png) [@michaelderekjones](https://community.postman.com/u/michaelderekjones)\ **Post date:** [November 1, 2022, 1:13pm UTC](https://community.postman.com/t/x-api-auth-failure-not-authorized-answer/40666/2 "2022-11-01T13:13:46Z")
Does the documentation say where this needs to be added. The header, or the body? ---
**Author:** ![w4dd325](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/w4dd325/32/12436_2.png) [@w4dd325](https://community.postman.com/u/w4dd325)\ **Post date:** [November 1, 2022, 1:47pm UTC](https://community.postman.com/t/x-api-auth-failure-not-authorized-answer/40666/3 "2022-11-01T13:47:01Z")
> [@adriano.ellero](#): > > a message signature Does the doc also state how the value is signed? ---
**Author:** ![adriano.ellero](https://avatars.discourse-cdn.com/v4/letter/a/5daacb/32.png) [@adriano.ellero](https://community.postman.com/u/adriano.ellero)\ **Post date:** [November 1, 2022, 3:37pm UTC](https://community.postman.com/t/x-api-auth-failure-not-authorized-answer/40666/4 "2022-11-01T15:37:46Z")
as I wrote in the question, To authenticate, you must add to your request the header `X-API-Auth` containing the API Key and a message signature… So to the header ---
**Author:** ![adriano.ellero](https://avatars.discourse-cdn.com/v4/letter/a/5daacb/32.png) [@adriano.ellero](https://community.postman.com/u/adriano.ellero)\ **Post date:** [November 1, 2022, 3:45pm UTC](https://community.postman.com/t/x-api-auth-failure-not-authorized-answer/40666/5 "2022-11-01T15:45:45Z")
good question! this what I have found: To authenticate, you must add to your request the header `X-API-Auth` containing the API Key and a message signature: ```auto X-API-Auth: : ``` The authentication code of the request is computed by applying a HMAC\_SHA512 on the request you’re about to send to the server. The message to authenticate has to respect the following specification (in pseudo code): ```auto messageToSign = HttpMethod + '\n' RelativePath + '\n' CanonicalQuery + '\n' Body + '\n' Timestamp ``` where: - **HttpMethod** : Can be either `GET`, `POST` or `PUT`, **mandatory** in all requests - **RelativePath** : is a canonical url stripped of the base path, i.e. if you request `https://...test.com/v1/devices` that would be `/v1/devices`, \*\* mandatory\*\* in all requests - **CanonicalQuery** : the encoded query, to be provided only if there is a query, for example: ```auto property=temperature&since=1286705410000 ``` - **Body** : the exact json body to be sent, to be provided only if there is a body to send - **Timestamp** : in milliseconds. If provided, the request will only be valid for 60 seconds after this timestamp. It also has to be provided in the header in `X-API-Timestamp`. This message is then authenticated using HMAC\_SHA512 and its result base64 encoded. The final result is what we previously called `request-hmac-512-authentication-code`, or in short a “signature”. So it looks like a token request… ---
**Author:** ![w4dd325](https://sea2.discourse-cdn.com/getpostman/user_avatar/community.postman.com/w4dd325/32/12436_2.png) [@w4dd325](https://community.postman.com/u/w4dd325)\ **Post date:** [November 1, 2022, 7:43pm UTC](https://community.postman.com/t/x-api-auth-failure-not-authorized-answer/40666/6 "2022-11-01T19:43:49Z")
So if it needs to be signed with HMAC Sha512 then you will need some code in the pre-req script. There are Postman examples here (collection called “Encrypt parameters using CryptoJS”): [https://www.postman.com/postman/workspace/postman-answers/collection/18070393-66f7caac-3005-44b2-8620-16dfb64a35f4?action=share&creator=22617629](https://www.postman.com/postman/workspace/postman-answers/collection/18070393-66f7caac-3005-44b2-8620-16dfb64a35f4?action=share&creator=22617629) But I also found this that could be what you need (with a few tweaks): >