V4 API returns 401 "Invalid or missing authorization token" on every endpoint (Adobe-linked account, valid IMS token)

Help
1

Setup

I have an OAuth integration built on the Adobe Developer Console using a User Authentication (Web App) credential. The token flow works end to end: the refresh-token grant against Adobe IMS returns 200, and the resulting access token is accepted by Adobe’s own identity endpoint (/ims/userinfo/v2 returns 200 and correctly identifies my user). So the credential is live and the identity is valid on Adobe’s side.

The core symptom: a valid Adobe token that V4 rejects

Despite that valid token, every Frame.io V4 REST endpoint returns 401 “Invalid or missing authorization token.” This includes the bare /v4/accounts call, which takes no account id, so it is not a scoping or path problem. The rejection happens at the authentication layer, before any account or resource is resolved. This started on the same day across all endpoints; the integration was returning data the day before with no config changes on my end.

I have already completed every item on the standard troubleshooting checklist

To save us a round trip, here is the standard checklist (as seen in the related thread on this forum about an Adobe IMS token that works but is not authorized for the Frame.io API) already confirmed done on my account:

  • My Frame.io account is connected to an Adobe ID. Under Settings then Authentication it shows “Manage on Adobe,” confirming the account-linking step.

  • The Frame.io V4 API product is added to my Adobe Developer Console project and appears under Connected products and services.

  • The credential is a User Authentication (Web App) OAuth credential, not a server-to-server credential.

  • The redirect URI is configured and the consent flow completes successfully (the user clicks Allow and a token is issued).

  • I am requesting the scopes the project provides, with no modifications.

With all of the above in place, /v4/accounts still returns 401. This matches the comment in that thread that a 401 here means there is “no route to Frame.io from the Dev Console for that user,” which points at a provisioning or entitlement gap on the Frame.io side rather than anything configurable in the Developer Console.

Diagnostics already done

  • Confirmed the token is a valid Adobe identity (/ims/userinfo/v2 returns 200).

  • Confirmed the failure is not version-header related. The only api-version value the API recognizes is experimental; other values return 422 “Invalid api version.” The bare /v4/accounts call returns 401 both with and without the header, so the rejection is upstream of version routing.

  • Re-ran the consent flow several times and minted fresh tokens, with no change.

  • Confirmed the same token authenticates fine to Adobe but is rejected only by api.frame.io.

Question

Given that the Adobe-side configuration is complete and the issued token is a valid Adobe identity, what provisioning step links my Developer Console app and user to V4 API access on my Frame.io account? Is there a known migration or change that would have revoked existing app grants and require re-provisioning on the Frame.io side?

2

Hi @brad!

Thanks for letting us know about this. I sent you a direct message to get some account-specific details so I can look into this for you on my end.

3

I have this issue too. Can you help me out? Thanks!

4

Hi @justinraine! Sorry for the delay here, this got caught in our spam filters.

Here’s a troubleshooting checklist to tackle the most common causes of this error:

  • Assuming IMS is issuing a token, confirm you have requested the correct scopes. You can decode the token on your end to check. You can use jwt.io to do so, or if you’d rather not paste your token into a webapp, run this in your terminal:
echo "YOUR_JWT_HERE" | jq -R 'split(".") | .[0:2] | map(@base64d) | map(fromjson)'
  • Head over to this page of our docs, hit ‘Login’ and send over the response you get?
    (Note: When you log in, make sure it is with the account you’ve been using for your API requests.)
  • This only applies if you belong to multiple accounts, but if you do, make sure you clear your cache when you are completing the login step of the OAuth flow. Either that, or do so from a browser you have never logged in with. The reason for this is that each of those accounts you belong to is separate in our system, and the correct account must be selected in order to access that account’s workspaces, projects, etc. Once an account is selected, it is remembered as the default, and subsequent logins will use it automatically. Starting with a fresh cache (or from a browser you’ve never logged in with) clears the session, so you’ll be prompted to select an account to act in again at login.

Separately, if you’re working in Python or TypeScript, our SDKs handle the auth flow, so I’d recommend going that route if you’re able. Linking them below:

Hope this helps!