# Bug OP-10057 - API responses inconsistent between Bearer tokens and API tokens

Project: OpenProject
Status: closed
URL: https://community.openproject.org/work_packages/OP-10057

## Open points

_No work packages_

## Details

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Module |  |
| Target versions | 12.1.0 |
| Observed in versions |  |
| Sprint | 12.1.0 |
| Backlog bucket |  |
| Bug found in version (deprecated) |  |
| Found in mobile app version |  |
| Follow-up feedback e-mail |  |
| Requires doc change | No |
| Accessibility | No |
| Pull preview |  |
| List |  |
| Labels |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable | Wieland Lindenthal |
| Product manager |  |
| Developers |  |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Planning

| Attribute | Value |
| --- | --- |
| Relevance |  |

## Costs

| Attribute | Value |
| --- | --- |
| Votes |  |
| Work |  |
| Labor costs |  |

## Description

There are currently three methods to authenticate against the OpenProject API

  - Session cookie (as used in the normal OpenProject frontend)
  - Basic Auth with a user's API token
  - Bearer Token as used in OAuth2 clients

### Actual behavior

On a public OpenProject instance a request to some endpoints such as `/api/v3/projects` result in very different responses (tested on a "public" local machine with 8 public and 12 private projects).

<figure class="table op-uc-figure_align-center op-uc-figure"><table class="op-uc-table"><tbody><tr class="op-uc-table--row"><td class="op-uc-table--cell"><strong>Method</strong></td><td class="op-uc-table--cell"><strong>Response when token valid</strong></td><td class="op-uc-table--cell"><strong>Response when token invalid</strong></td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell">Session cookie</td><td class="op-uc-table--cell">200 OK, 20 projects</td><td class="op-uc-table--cell">200 OK, 8 projects</td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell">Basic auth with API token</td><td class="op-uc-table--cell">200 OK, 20 projects</td><td class="op-uc-table--cell">401 Unauthorized</td></tr><tr class="op-uc-table--row"><td class="op-uc-table--cell">Bearer Token (OAuth)</td><td class="op-uc-table--cell">200 OK, 20 projects</td><td class="op-uc-table--cell">200 OK, 8 projects</td></tr></tbody></table></figure>

### Expected behavior

I expect that all API calls return the same responses when the authentication is invalid, a `401 Unauthorized`. However, I see that our frontend is currently not ready for a strict 401. The frontend would need to communicate the user that the current session is invalid and that it needs to be reinitiated. That is quite some task that I would go beyond this work package here.

The situation is different for the other two authentication methods. I don't see a reason why Basich Auth and Bearer Token should behave differently. Both authentication methods are typically used for machine to machine integration. I expect that both to behave the same. Invalid, autodated or revoked tokens should return a 401.