# Jupyterhub API Forbidden (403) Code

**URL:** https://discourse.jupyter.org/t/jupyterhub-api-forbidden-403-code/13209
**Category:** Zero to JupyterHub on Kubernetes
**Created:** [March 1, 2022, 2:33pm UTC](https://discourse.jupyter.org/t/jupyterhub-api-forbidden-403-code/13209 "2022-03-01T14:33:32Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![agelosnm](https://yyz1.discourse-cdn.com/flex031/user_avatar/discourse.jupyter.org/agelosnm/32/10273_2.png) [@agelosnm](https://discourse.jupyter.org/u/agelosnm)
#### Post date: [March 1, 2022, 2:33pm UTC](https://discourse.jupyter.org/t/jupyterhub-api-forbidden-403-code/13209/1 "2022-03-01T14:33:32Z")

</div>

Hello!

I have setup my k8s cluster and installed succesfully jupyterhub using Helm.

I’m trying to utilize the API, but I’m getting “Forbidden” status code.  
The procedure that I’m following is to login to jupyterhub, then go to “Token” menu and “Request new API token”. Then, I’m taking the generated token and use it as Authorization header to Postman.

 ![image](https://canada1.discourse-cdn.com/flex031/uploads/jupyter/original/2X/3/338e681e9265ba89cc4c95c9e5e0de5f4d4c36e8.png)

---

<div class="post-metadata">

### Author: ![arthurian](https://yyz1.discourse-cdn.com/flex031/user_avatar/discourse.jupyter.org/arthurian/32/6483_2.png) [@arthurian](https://discourse.jupyter.org/u/arthurian)
#### Post date: [March 2, 2022, 2:08am UTC](https://discourse.jupyter.org/t/jupyterhub-api-forbidden-403-code/13209/2 "2022-03-02T02:08:41Z")

</div>

It looks like your **Authorization** header value is missing the word `token` before the actual API token value. In other words, change this:

```auto
Authorization: YOUR_API_TOKEN

```

To this:

```auto
Authorization: token YOUR_API_TOKEN

```

See also: [Using JupyterHub’s REST API — JupyterHub 2.1.1 documentation](https://jupyterhub.readthedocs.io/en/stable/reference/rest.html#make-an-api-request)

---

<div class="post-metadata">

### Author: ![agelosnm](https://yyz1.discourse-cdn.com/flex031/user_avatar/discourse.jupyter.org/agelosnm/32/10273_2.png) [@agelosnm](https://discourse.jupyter.org/u/agelosnm)
#### Post date: [March 2, 2022, 8:05am UTC](https://discourse.jupyter.org/t/jupyterhub-api-forbidden-403-code/13209/3 "2022-03-02T08:05:41Z")

</div>

I tried that too but my issue was that I was using the “dummy” authenticator class. Thus, there was not any admin user defined hence I couldn’t use the API. Upon configuring my .yml accordingly it works by using the authorization header as you mentioned.

```auto
hub:
  config:
    JupyterHub:
      admin_access: false
    Authenticator:
      admin_users:
        - admin

```

Then, by logging in as “admin” user, I generated the token from the /hub/token and I’m able to make API calls.