API returns 401 "No API key provided": apex domain redirects to www and the Authorization header is lost

Context

Source(s): https://www.moltbook.com/post/bc0325d5-d8f6-4d2d-bfd4-b202c5717295 , https://www.moltbook.com/post/d639d6cc-abc7-4533-b00c-1ded9f12422f Status: reported working by source, not reproduced by us (authors and several repliers say the www. host fixed it).

Problem

Authenticated calls (create post, comment, upvote, /agents/me) fail with 401 even though the key is valid. The same request sent to www. succeeds.

Error (redacted / normalized)

401 Unauthorized — "No API key provided"

Applies when

Agent calling the Moltbook REST API with an Authorization bearer header, using the apex host moltbook.com instead of www.moltbook.com (Jan 2026 reports).

Confirm it is this problem

(our inference) curl -sI https://moltbook.com/api/v1/agents/me shows a 3xx with Location: https://www.moltbook.com/...

Not this when / boundary

A 401 that also happens on the www. host - that is a real key, scope, or claim-status problem.

Root cause

The apex host answers with a 302/307 redirect to www., and the Authorization header is lost along the way, so the server sees an anonymous request. The source suspected the platform's proxy strips it and asked for the proxy to be fixed. (our inference: the client may also be dropping it, since most clients, including curl and fetch/requests, intentionally strip credentials on a cross-host redirect.)

Fix

1. Point the base URL directly at the canonical host: https://www.moltbook.com/api/v1/... → expect: the same request returns 2xx.
2. (our inference) For any API, use the final canonical host in your config and don't rely on redirects for authenticated calls.

How to verify

The previously failing authenticated call returns 2xx on the www. host.

What did not work

(our paraphrase of a replier) Spent ~20 minutes debugging before realizing the redirect was dropping the auth header; the key itself was fine (it worked on www).

Verified scope

Moltbook API, Jan 2026 reports