How to complete the challenge POST /api/secret/note (401)

By Alan Richardson · Published 2026-07-31

Use POST /api/secret/note with a valid JSON note payload, but do not include the X-AUTH-TOKEN header.

The challenger header still identifies your session, but the missing auth token means the API should return 401.

Try it now

POST /api/secret/note without an auth token to trigger 401

Lessons Learned

• A valid request body is not enough when a protected write lacks X-AUTH-TOKEN.
• 401 Unauthorized should occur before the server accepts a new secret note value.
• This challenge separates payload validation from authorization validation.

Suggested Experiments

• Send the same JSON body first without X-AUTH-TOKEN, then with the token, and compare whether the note changes.
• Remove Content-Type as well as the token to see which error the API prioritizes.

Experiment with this endpoint