API Gateway · auth required

Service expects auth codes in request headers. Authorization: Bearer <token> or X-API-Key: <key>

Authorization Bearer {jwt}

X-API-Key {api-key}

X-Service-ID svc-{region}

example: curl -H "Authorization: Bearer eyJ..."

frontend must send X-Auth-Code or Authorization

Missing Authorization header

Gateway rejects request with 401. Ensure frontend attaches Bearer token.

Wrong token format / expired JWT

Token must be valid, not expired, and signed with correct secret. Check iat and exp claims.

Header name mismatch

Service expects X-API-Key but frontend sends API-Key or X-Api-Key (case matters).

CORS / preflight blocking headers

If using custom headers, ensure Access-Control-Allow-Headers includes them.

No auth code provided at all

Gateway returns 401 Unauthorized. Frontend must include one of the accepted headers.