# Invalid API token generated
**URL:** https://community.fibery.io/t/invalid-api-token-generated/601
**Category:** Bugs & Issues
**Created:** [March 6, 2020, 1:49pm UTC](https://community.fibery.io/t/invalid-api-token-generated/601 "2020-03-06T13:49:42Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Haslien](https://community.fibery.io/u/Haslien)
#### Post date: [March 6, 2020, 1:49pm UTC](https://community.fibery.io/t/invalid-api-token-generated/601/1 "2020-03-06T13:49:42Z")
Following the steps in the [Authentication section of the API documentation](https://api.fibery.io/#authentication), it describes simply putting the snippet in your console while being logged in to your app, then using it in the [Get Schema](https://api.fibery.io/?shell#get-schema) endpoint.
**What happen?**
API returns
```auto
401 Unauthorized
{"message":"jwt malformed"}
```
**What was expected to happen?**
1. Getting a full and valid JWT from the initial token generation command.
2. A response with the schema, as shown [in the example](https://api.fibery.io/?shell#get-schema).
**Note**
I suspect that the token generated returns only a part of it. It does not conform to the JWT format of `[header].[payload].[verify]`.
Sample (invalidated): `u72eaff3.874aced889f24a44881c2g6770de3h22e8f`
---
### Author:  [@Sergey\_Truhtanov](https://community.fibery.io/u/Sergey_Truhtanov)
#### Post date: [March 6, 2020, 6:58pm UTC](https://community.fibery.io/t/invalid-api-token-generated/601/2 "2020-03-06T18:58:16Z")
Hello. Could your please send XHR of the request that you execute and get “jwt malformed” as a response. Or just send body and headers of the request.
---
### Author:  [@Haslien](https://community.fibery.io/u/Haslien)
#### Post date: [March 6, 2020, 7:38pm UTC](https://community.fibery.io/t/invalid-api-token-generated/601/3 "2020-03-06T19:38:01Z")
Hi,
As I performed the query again to show you everything in one screenshot, I moved where token is placed and got the expected response. Confused me how it would work now, so I tested previous setup.
Seems I presumed wrong prefix for Postman’s ‘Authorization’, so it sent `Authorization: Bearer {token}` instead of `Authorization: Token {token}`. My bad, I should have tested that. Sorry for wasting your time.
TL;DR it sent `Bearer {token}` when `Token {Token}` was required, and it responded with `jwt malformed`.
---
### Author:  [@Sergey\_Truhtanov](https://community.fibery.io/u/Sergey_Truhtanov)
#### Post date: [March 6, 2020, 7:53pm UTC](https://community.fibery.io/t/invalid-api-token-generated/601/4 "2020-03-06T19:53:13Z")
Yep, that was the reason of the error. We do use jwt tokens internally, that’s why ‘Bearer’ schema (which is a part of jwt spec) is supported on our side. But our api tokens, that we allow users to generate, are not jwt tokens. At you’ve correctly spotted this in original question. That’s why we use ‘Token’ schema in Authorization header.
---
### Author:  [@San](https://community.fibery.io/u/San)
#### Post date: [December 10, 2021, 6:29am UTC](https://community.fibery.io/t/invalid-api-token-generated/601/5 "2021-12-10T06:29:46Z")
Where did you get the TOKEN? Or how to generate it?
---
### Author:  [@Haslien](https://community.fibery.io/u/Haslien)
#### Post date: [December 10, 2021, 8:51am UTC](https://community.fibery.io/t/invalid-api-token-generated/601/6 "2021-12-10T08:51:18Z")
You can check the [API documentation about it here](https://api.fibery.io/#manage-existing-tokens) 🙂
1. Copy this code
```auto
fetch(`https://${window.location.host}/api/tokens`, { method: 'GET' })
.then(res => res.json())
.then(apiKeys => console.log(apiKeys))
```
1. Navigate to your Fibery workspace that you wish to generate token for
2. Open developer tools, the shortcut for it is usually Ctrl+Shift+i
3. Navigate to the “Console” tab
4. Paste the code you copied. It should display the token in the console