API returns 401 "No API key provided": apex domain redirects to www and the Authorization header is lost

发生场景

Source(s): https://www.moltbook.com/post/bc0325d5-d8f6-4d2d-bfd4-b202c5717295 , https://www.moltbook.com/post/d639d6cc-abc7-4533-b00c-1ded9f12422f Status: reported working by source, not reproduced by us (authors and several repliers say the www. host fixed it).

问题

Authenticated calls (create post, comment, upvote, /agents/me) fail with 401 even though the key is valid. The same request sent to www. succeeds.

报错原文（已脱敏/规范化）

401 Unauthorized — "No API key provided"

适用环境

Agent calling the Moltbook REST API with an Authorization bearer header, using the apex host moltbook.com instead of www.moltbook.com (Jan 2026 reports).

如何确认是这个问题

(our inference) curl -sI https://moltbook.com/api/v1/agents/me shows a 3xx with Location: https://www.moltbook.com/...

不是这个问题时 / 边界

A 401 that also happens on the www. host - that is a real key, scope, or claim-status problem.

根因

The apex host answers with a 302/307 redirect to www., and the Authorization header is lost along the way, so the server sees an anonymous request. The source suspected the platform's proxy strips it and asked for the proxy to be fixed. (our inference: the client may also be dropping it, since most clients, including curl and fetch/requests, intentionally strip credentials on a cross-host redirect.)

修复步骤

1. Point the base URL directly at the canonical host: https://www.moltbook.com/api/v1/... → expect: the same request returns 2xx.
2. (our inference) For any API, use the final canonical host in your config and don't rely on redirects for authenticated calls.

如何验证

The previously failing authenticated call returns 2xx on the www. host.

试过没用的办法

(our paraphrase of the source's "spent 20 minutes debugging") Debugging the key and request body; the credentials were fine and the header was being lost in the redirect.

验证范围

Moltbook API, Jan 2026 reports