# httpInterceptor does not add authorization header

**URL:** <https://community.auth0.com/t/httpinterceptor-does-not-add-authorization-header/99049>\
**Category:** JWT.io\
**Tags:** jwt, api, authorization, access-token, angular, auth0, login\
**Created:** [January 26, 2023, 6:48pm UTC](https://community.auth0.com/t/httpinterceptor-does-not-add-authorization-header/99049 "2023-01-26T18:48:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![guillaume.canu78](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/guillaume.canu78/32/44001_2.png) [@guillaume.canu78](https://community.auth0.com/u/guillaume.canu78)\
**Post date:** [January 26, 2023, 6:48pm UTC](https://community.auth0.com/t/httpinterceptor-does-not-add-authorization-header/99049/1 "2023-01-26T18:48:10Z")

</div>

Hello, I know this topics has been asked many times already but I did not find a solution.

I followed all steps from Auth0 turials to add Auth0 authentication on an Angular App, but after many hours, I can’t do a request to my API. It always send my a 401 error.

I’m on a development environment. I develop with Angular 13 framework and @auth0/auth0-angular 2.0.0

I set up a SPA on auth0 dashboard, and also an API.

Here’s the code I use on app.module.ts

```auto
AuthModule.forRoot({
      domain: 'xxxx.auth0.com',
      clientId: 'xxxxxx',
      authorizationParams: {
        redirect_uri: 'http://localhost:4200/dashboard',
        // Request this audience at user authentication time
        audience: 'http://localhost:4200/api',

      },
      httpInterceptor: {
        allowedList: ['http://localhost:4200/api/someRequest'],
      },
    }),

```

When I access to my Angular App, I see the /auth/token request and it return a 200 code. In the response, I can see access\_token, expires\_in, id\_token, scope and token\_type.

But when I request my API, I don’t see the Authorization header attached to the request.

I don’t know where these tokens are normally stored (localStorage, sessionStorage, …)

I saw on similar topics, it might have a limitation on dev envs. How about this ? Is it supposed to work in dev ?

Thanks for your replies

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [January 26, 2023, 8:47pm UTC](https://community.auth0.com/t/httpinterceptor-does-not-add-authorization-header/99049/3 "2023-01-26T20:47:25Z")

</div>

Hey there @guillaume.canu78 welcome to the community!

> [@guillaume.canu78](#):
>
> But when I request my API, I don’t see the Authorization header attached to the request.
> 
> I don’t know where these tokens are normally stored (localStorage, sessionStorage, …)

I’m guessing the token is not attached due to an issue with your `httpInterceptor` config and in particular the `allowedList` - Might be worth taking a look at how our [sample app](https://github.com/auth0-samples/auth0-angular-samples/blob/7cb57230df72dc6f3220bc6797cb153954989d9f/Sample-01/src/environments/environment.ts#L27) goes about this. In the sample the `apiUri` is `https://localhost:3001` and the external API is at `https://localhost:3001/api/external`.

> [@guillaume.canu78](#):
>
> I saw on similar topics, it might have a limitation on dev envs. How about this ? Is it supposed to work in dev ?

It should work totally fine in a dev environment. Again, you might want to check out the sample I linked to previously in order to compare against.

Hope this helps, keep us posted!

---

<div class="post-metadata">

**Author:** ![jovan.somborski28](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jovan.somborski28/32/44166_2.png) [@jovan.somborski28](https://community.auth0.com/u/jovan.somborski28)\
**Post date:** [January 31, 2023, 9:22am UTC](https://community.auth0.com/t/httpinterceptor-does-not-add-authorization-header/99049/4 "2023-01-31T09:22:43Z")

</div>

> [@guillaume.canu78](#):
>
> `http://localhost:4200/api/`

Hey, try with [http://localhost:4200/](http://localhost:4200/)\*\*\*\*\*

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [January 31, 2023, 11:45pm UTC](https://community.auth0.com/t/httpinterceptor-does-not-add-authorization-header/99049/5 "2023-01-31T23:45:47Z")

</div>

Hey thanks for jumping in @jovan.somborski28 - That’s correct, something like `http://localhost:4200/*` should work.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [February 14, 2023, 11:46pm UTC](https://community.auth0.com/t/httpinterceptor-does-not-add-authorization-header/99049/6 "2023-02-14T23:46:00Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.