# Auth Not Working for Protected API - Query Param configuration missing? (Angular & Node)

**URL:** <https://community.auth0.com/t/auth-not-working-for-protected-api-query-param-configuration-missing-angular-node/67783>\
**Category:** Get Help\
**Tags:** node, jwt, authentication-api, query-parameters, angular\
**Created:** [August 11, 2021, 8:06pm UTC](https://community.auth0.com/t/auth-not-working-for-protected-api-query-param-configuration-missing-angular-node/67783 "2021-08-11T20:06:01Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![EyeG](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/eyeg/32/30789_2.png) [@EyeG](https://community.auth0.com/u/EyeG)\
**Post date:** [August 11, 2021, 8:06pm UTC](https://community.auth0.com/t/auth-not-working-for-protected-api-query-param-configuration-missing-angular-node/67783/1 "2021-08-11T20:06:01Z")

</div>

Hey Auth0 Community,

I followed the quickstart guide via [Youtube](https://www.youtube.com/watch?v=IQf2eyY0wgw&t=874s) to set up an Angular app to use Auth0. Overall, it was extremely helpful.

My login/logout is working. My route guards are working.

**My problem** : My API call keeps returning a 401 Unauthorized and I can’t figure out why.

Stack:  
Angular Front-End  
Node.js (using Express) backend  
Mongo DB

My thought: My api call uses a query parameter that comes from a value in a drop down list in my Angular app. I am wondering if query params create an issue with the HTTP\_Interceptor for authentication.

I haven’t found anything about this in the community forums or online, but to be honest, I may not be googling the right terms, as I am still pretty new to all of this.

Here are some screen shots to help explain.

**Front End**

My component calls to my service

 ![image](https://global.discourse-cdn.com/auth0/original/3X/9/0/90d0ca642fb49bf27d19df1a447663a12fa2a6f0.png)

I have a service that handles my http calls.

 ![image](https://global.discourse-cdn.com/auth0/original/3X/6/e/6ecb7e4a3a131e8a2c04df01cf627a6c04ae566b.png)

I think all my env, config and module files are set up correctly:

 ![image](https://global.discourse-cdn.com/auth0/original/3X/2/c/2c824bff0aed1504ea153bdf62b0cae74607595b.png)

![image](https://global.discourse-cdn.com/auth0/original/3X/7/2/72177b1f5c86bbbf43a738e5fc47acb52fbfd132.png)

Note: I hardcoded my “allowedList:” property so I could test it, but the “Halo” value is the query param. If I leave it blank, I get the same result. This is where I think the issue is

![image](https://global.discourse-cdn.com/auth0/original/3X/a/9/a90c79bf2e497b18075d3a82a0503262ebeb89d0.png)

**Backend (Node)**

My route is called via my Front end

![image](https://global.discourse-cdn.com/auth0/original/3X/9/9/996ae97c853bf89e7fa390f44e53ff155bc10947.png)

Jwt file  
 ![image](https://global.discourse-cdn.com/auth0/original/3X/f/1/f1c3dd9ca455f56e21211da6a225efda231fd661.png)

When everything is served up and I select an item from the drop down and submit, this is what I see in the console

 ![image](https://global.discourse-cdn.com/auth0/original/3X/8/2/820e6a9df8dfb89e3f6df9cbecb0c64d080316d0.png)

Here is my network calls

 ![image](https://global.discourse-cdn.com/auth0/original/3X/0/8/08f6a9542e87f02dabed8be57b160624a1ca6535.png)

Let me know what you think or if you have questions. Thank you in advance!

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [August 11, 2021, 9:10pm UTC](https://community.auth0.com/t/auth-not-working-for-protected-api-query-param-configuration-missing-angular-node/67783/3 "2021-08-11T21:10:04Z")

</div>

Hi @EyeG,

Welcome to the Auth0 Community!

Have you tried to decode the token and see if it has all the necessary claims? You can post it here (with sensitive data redacted) and I’d be happy to take a look.

---

<div class="post-metadata">

**Author:** ![EyeG](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/eyeg/32/30789_2.png) [@EyeG](https://community.auth0.com/u/EyeG)\
**Post date:** [August 11, 2021, 9:36pm UTC](https://community.auth0.com/t/auth-not-working-for-protected-api-query-param-configuration-missing-angular-node/67783/4 "2021-08-11T21:36:41Z")

</div>

Hi @dan.woda !

Thanks for responding! I did decode it but to be honest, I am not totally sure what I am looking for once I do decode it.

Here is what I see in the network:

![image](https://global.discourse-cdn.com/auth0/original/3X/c/2/c2e4e8547fbd49caa29017ad4b2f855a451d0e93.png)

When I decode the Access\_Token, here is what I get (not exactly sure what is sensitive v. what is not - but I know I can change some of this stuff if it is sensitive ):

 ![image](https://global.discourse-cdn.com/auth0/original/3X/f/f/ff4a7d01967c6e2f01d7d2116172420a99d10acb.png)

When I decode the id\_token

 ![image](https://global.discourse-cdn.com/auth0/original/3X/6/9/690c67d5b82337ce9045c211e3bc1f10fac8fa73.png)

Hope that helps. Thanks your again for responding! Let me know if you have questions.

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [August 12, 2021, 8:28pm UTC](https://community.auth0.com/t/auth-not-working-for-protected-api-query-param-configuration-missing-angular-node/67783/5 "2021-08-12T20:28:17Z")

</div>

Does your audience and issuer match the settings you set up in your checkJwt method?

---

<div class="post-metadata">

**Author:** ![EyeG](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/eyeg/32/30789_2.png) [@EyeG](https://community.auth0.com/u/EyeG)\
**Post date:** [August 13, 2021, 12:06am UTC](https://community.auth0.com/t/auth-not-working-for-protected-api-query-param-configuration-missing-angular-node/67783/6 "2021-08-13T00:06:41Z")

</div>

@dan.woda

So here is what I see, not sure if this is right, which may be the issue. I’ll change the configuration of this afterward, so I don’t mind sharing.

**Backend files (node)**

Env file  
 ![image](https://global.discourse-cdn.com/auth0/original/3X/e/b/eb6dfc64b0d24281c37bda86bde2a86ba1015464.png)

check-jwt file

 ![image](https://global.discourse-cdn.com/auth0/original/3X/d/c/dcdb5eda81518c871ad88cfd921c110e1d20773d.png)

**Front End files**

Auth\_Config.json file  
 ![image](https://global.discourse-cdn.com/auth0/original/3X/f/a/fa8552459c57891dd712866319ab9d28604cbf55.png)

Angular Env file

 ![image](https://global.discourse-cdn.com/auth0/original/3X/3/2/32034ba6c3a39e5a80e94aef967022463fa993f8.png)

**Network Calls/Tokens**

access\_token decoded

 ![image](https://global.discourse-cdn.com/auth0/original/3X/7/4/7452b9555e002e30e41bf7a7ab23349412e3b449.png)

id\_token decoded

 ![image](https://global.discourse-cdn.com/auth0/original/3X/9/d/9d20e3cb75d7e0137c0b51ae6904d4804dfcf9a9.png)

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [August 13, 2021, 5:43pm UTC](https://community.auth0.com/t/auth-not-working-for-protected-api-query-param-configuration-missing-angular-node/67783/7 "2021-08-13T17:43:59Z")

</div>

It looks like your checkJWT method is repeating the `https://` and trailing `/` for your issuer

i.e. `https://https://dev-xxxx.us.auth0.com//`

---

<div class="post-metadata">

**Author:** ![EyeG](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/eyeg/32/30789_2.png) [@EyeG](https://community.auth0.com/u/EyeG)\
**Post date:** [August 13, 2021, 6:28pm UTC](https://community.auth0.com/t/auth-not-working-for-protected-api-query-param-configuration-missing-angular-node/67783/8 "2021-08-13T18:28:48Z")

</div>

@dan.woda

Great idea! I made the changes, but unfortunetly still getting a 401 unauthorized 😦

node env file  
 ![image](https://global.discourse-cdn.com/auth0/original/3X/0/d/0db19df1c58d24c05a00214892d211068b816d2d.png)

jwt file

 ![image](https://global.discourse-cdn.com/auth0/original/3X/f/2/f2714811b84b4f277106370987c0354e5eda90bd.png)

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [August 13, 2021, 8:01pm UTC](https://community.auth0.com/t/auth-not-working-for-protected-api-query-param-configuration-missing-angular-node/67783/9 "2021-08-13T20:01:22Z")

</div>

Does the error give any more information? Usually it will say something like `bad audience` or `invalid issuer`

---

<div class="post-metadata">

**Author:** ![EyeG](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/eyeg/32/30789_2.png) [@EyeG](https://community.auth0.com/u/EyeG)\
**Post date:** [August 14, 2021, 1:13pm UTC](https://community.auth0.com/t/auth-not-working-for-protected-api-query-param-configuration-missing-angular-node/67783/10 "2021-08-14T13:13:23Z")

</div>

@dan.woda

I didn’t see anything about audience or invalid issuer. At least not yet.

I’ve been trying to debug this morning, but still no luck. It just seems odd that my route guards are working, log in is working, but my API can’t find my token. I

Here are my errors in the conosle.

 ![image](https://global.discourse-cdn.com/auth0/original/3X/1/9/19d617b31b2750daf90104be066d494999bbbec0.png)

For the “error” property", I think this is the stack trace, and I am trying to follow it, but it seems like all the errors are stemming from a node-module.

```auto
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Error</title>
</head>
<body>
<pre>UnauthorizedError: No authorization token was found<br> &nbsp; &nbsp;at middleware (C:\Users\gilma\Documents\Dev\QUp\qUpBACKEND\node_modules\express-jwt\lib\index.js:79:21)<br> &nbsp; &nbsp;at Layer.handle [as handle_request] (C:\Users\gilma\Documents\Dev\QUp\qUpBACKEND\node_modules\express\lib\router\layer.js:95:5)<br> &nbsp; &nbsp;at next (C:\Users\gilma\Documents\Dev\QUp\qUpBACKEND\node_modules\express\lib\router\route.js:137:13)<br> &nbsp; &nbsp;at Route.dispatch (C:\Users\gilma\Documents\Dev\QUp\qUpBACKEND\node_modules\express\lib\router\route.js:112:3)<br> &nbsp; &nbsp;at Layer.handle [as handle_request] (C:\Users\gilma\Documents\Dev\QUp\qUpBACKEND\node_modules\express\lib\router\layer.js:95:5)<br> &nbsp; &nbsp;at C:\Users\gilma\Documents\Dev\QUp\qUpBACKEND\node_modules\express\lib\router\index.js:281:22<br> &nbsp; &nbsp;at Function.process_params (C:\Users\gilma\Documents\Dev\QUp\qUpBACKEND\node_modules\express\lib\router\index.js:335:12)<br> &nbsp; &nbsp;at next (C:\Users\gilma\Documents\Dev\QUp\qUpBACKEND\node_modules\express\lib\router\index.js:275:10)<br> &nbsp; &nbsp;at Function.handle (C:\Users\gilma\Documents\Dev\QUp\qUpBACKEND\node_modules\express\lib\router\index.js:174:3)<br> &nbsp; &nbsp;at router (C:\Users\gilma\Documents\Dev\QUp\qUpBACKEND\node_modules\express\lib\router\index.js:47:12)<br> &nbsp; &nbsp;at Layer.handle [as handle_request] (C:\Users\gilma\Documents\Dev\QUp\qUpBACKEND\node_modules\express\lib\router\layer.js:95:5)<br> &nbsp; &nbsp;at trim_prefix (C:\Users\gilma\Documents\Dev\QUp\qUpBACKEND\node_modules\express\lib\router\index.js:317:13)<br> &nbsp; &nbsp;at C:\Users\gilma\Documents\Dev\QUp\qUpBACKEND\node_modules\express\lib\router\index.js:284:7<br> &nbsp; &nbsp;at Function.process_params (C:\Users\gilma\Documents\Dev\QUp\qUpBACKEND\node_modules\express\lib\router\index.js:335:12)<br> &nbsp; &nbsp;at next (C:\Users\gilma\Documents\Dev\QUp\qUpBACKEND\node_modules\express\lib\router\index.js:275:10)<br> &nbsp; &nbsp;at urlencodedParser (C:\Users\gilma\Documents\Dev\QUp\qUpBACKEND\node_modules\body-parser\lib\types\urlencoded.js:91:7)</pre>
</body>
</html>

```

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [August 16, 2021, 4:16pm UTC](https://community.auth0.com/t/auth-not-working-for-protected-api-query-param-configuration-missing-angular-node/67783/11 "2021-08-16T16:16:03Z")

</div>

That error message is helpful.

Can you look at the network tab of devtools, and see if the token is being sent in the request?

You should see an `Authorization` header with the token. Like this:

 ![image](https://global.discourse-cdn.com/auth0/original/3X/d/f/df91eee93edf8ba3d4b9a0c8f390836eaa25dd23.png)

---

<div class="post-metadata">

**Author:** ![EyeG](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/eyeg/32/30789_2.png) [@EyeG](https://community.auth0.com/u/EyeG)\
**Post date:** [August 16, 2021, 4:51pm UTC](https://community.auth0.com/t/auth-not-working-for-protected-api-query-param-configuration-missing-angular-node/67783/12 "2021-08-16T16:51:38Z")

</div>

@dan.woda

Hmm, it’s not. I don’t really understand why tho. Is it the http interceptor? I’ll google a bit and if I figure it out before you reply, I’ll let you know

Here is the screen shot

 ![image](https://global.discourse-cdn.com/auth0/original/3X/a/d/ad9980cc019752ed452cb821b3518ab551af656a.png)

---

<div class="post-metadata">

**Author:** ![EyeG](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/eyeg/32/30789_2.png) [@EyeG](https://community.auth0.com/u/EyeG)\
**Post date:** [August 16, 2021, 8:43pm UTC](https://community.auth0.com/t/auth-not-working-for-protected-api-query-param-configuration-missing-angular-node/67783/13 "2021-08-16T20:43:00Z")

</div>

More I am reading, a few questions come to mind that maybe will help.

1. Is it an issue that I don’t have any permissions/scopes set?

2. For query params, should I use an \* at the end of the API end point as a wildcard? (ie: `${env.dev.serverUrl}?game=*`)

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [August 16, 2021, 9:06pm UTC](https://community.auth0.com/t/auth-not-working-for-protected-api-query-param-configuration-missing-angular-node/67783/14 "2021-08-16T21:06:37Z")

</div>

To be honest, I am not very familiar with Angular httpInterceptors.

I notice in our Angular + API quickstart we have pass an object with additional parameters to the allowed list, as well as a wildcard at the end of the API uri, which I would think makes any request (including query params) valid. Can you try to format it like our example and see if that works?

```auto
httpInterceptor: {
    allowedList: [
      {
        // Match any request that starts 'https://dan-woda-testing.auth0.com/api/v2/' (note the asterisk)
        uri: 'https://dan-woda-testing.auth0.com/api/v2/*',
        tokenOptions: {
          // The attached token should target this audience
          audience: 'https://dan-woda-testing.auth0.com/api/v2/',

          // The attached token should have these scopes
          scope: 'read:current_user'
        }
      }
    ]
  }

```

---

<div class="post-metadata">

**Author:** ![EyeG](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/eyeg/32/30789_2.png) [@EyeG](https://community.auth0.com/u/EyeG)\
**Post date:** [August 16, 2021, 9:25pm UTC](https://community.auth0.com/t/auth-not-working-for-protected-api-query-param-configuration-missing-angular-node/67783/15 "2021-08-16T21:25:30Z")

</div>

@dan.woda

Ok, so I got it to work lol. All I did was add the \* to the end of the URI. I didn’t add the scope, but maybe I’ll play around with it in the future.

Works like this if I remove everying after the ? (including the question mark).

![image](https://global.discourse-cdn.com/auth0/original/3X/7/7/771b604dbb40fde1be95bd7aafffcfe774d9a511.png)

And it works if I make the actually param a wildcard as well.

![image](https://global.discourse-cdn.com/auth0/original/3X/b/1/b1b9f89aac1e63eb56d54b93ed4c94e2242ed49c.png)

I guess the wildcard was the answer. For whatever reason the paramter wasn’t working when I hard coded it 🤷‍♂️

I think I am good now. I definitely appreciate your help! I was banging my head against the wall for a few days there.

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [August 17, 2021, 6:58pm UTC](https://community.auth0.com/t/auth-not-working-for-protected-api-query-param-configuration-missing-angular-node/67783/16 "2021-08-17T18:58:39Z")

</div>

Thanks for posting an update.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [September 1, 2021, 6:59pm UTC](https://community.auth0.com/t/auth-not-working-for-protected-api-query-param-configuration-missing-angular-node/67783/17 "2021-09-01T18:59:00Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.