# Web API authentication - Documentation bug?

**URL:** <https://community.sonarsource.com/t/web-api-authentication-documentation-bug/143039>\
**Category:** SonarQube Server / Community Build\
**Tags:** web\_api\
**Created:** [June 18, 2025, 12:37pm UTC](https://community.sonarsource.com/t/web-api-authentication-documentation-bug/143039 "2025-06-18T12:37:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![fransf-wtax](https://avatars.discourse-cdn.com/v4/letter/f/e56c9b/32.png) [@fransf-wtax](https://community.sonarsource.com/u/fransf-wtax)\
**Post date:** [June 18, 2025, 12:37pm UTC](https://community.sonarsource.com/t/web-api-authentication-documentation-bug/143039/1 "2025-06-18T12:37:33Z")

</div>

Hi all,

I want to use the web API and according to [SonarQube Server Web API | Documentation](https://docs.sonarsource.com/sonarqube-server/latest/extension-guide/web-api/) , you should pass in a user token as a bearer token in the Authorization header. This doesn’t work for me (I get a 401 response).

Then I see [several](https://community.sonarsource.com/t/web-api-401-when-using-tokens/108410) [posts](https://community.sonarsource.com/t/i-use-web-api-but-i-has-errors-with-401-unauthorzation/68671) on this community saying to use the token as a username with a blank password as a Basic authentication. That does work.

Is the documentation wrong? Why does it say to use the Bearer token authentication scheme when this obviously doesn’t work?

SonarQube 9.9.4 deployed using Docker.

Thanks,  
Frans

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [June 19, 2025, 9:01am UTC](https://community.sonarsource.com/t/web-api-authentication-documentation-bug/143039/3 "2025-06-19T09:01:09Z")

</div>

Hey there.

If you check the docs [specific to your version](https://docs.sonarsource.com/sonarqube-server/9.9/extension-guide/web-api/), you’ll find no reference to using `Bearer`. 🙂 This came later.

By the way, you need to [upgrade](https://frolicking-brigadeiros-1cba5a.netlify.app/)!

---

<div class="post-metadata">

**Author:** ![fransf-wtax](https://avatars.discourse-cdn.com/v4/letter/f/e56c9b/32.png) [@fransf-wtax](https://community.sonarsource.com/u/fransf-wtax)\
**Post date:** [June 19, 2025, 9:16am UTC](https://community.sonarsource.com/t/web-api-authentication-documentation-bug/143039/4 "2025-06-19T09:16:14Z")

</div>

Ah, of course! Thanks, hadn’t noticed that!

And yes, we do need to upgrade 🙂