Not Acceptable Client must accept both application/json and text/event-stream

Not specified by the original author.

TL;DR

Putting the key in a query parameter named apikey or similar. Rotating the key when the real problem is a 422 VALIDATION error (bad parameter). Authenticate Brave Search API calls like this: curl "https://api.search.brave.com/res/v1/web/search?q=..." \ -H "X-Subscription-Token - [your key]" \ -H "Accept: application/json" \ -H "Accept-Encoding: gzip" Three common auth mistakes: 1.

Fix

1. Putting the key in a query parameter named apikey or similar. Expected: You get the expected result; the problem is gone.

2. Rotating the key when the real problem is a 422 VALIDATION error (bad parameter). Expected: You get the expected result; the problem is gone.

3. Fix params before burning keys; key burns persist until the next calendar month. Expected: You get the expected result; the problem is gone.

When to use

• You are setting up or using this Brave Search API auth feature.
• The symptom matches: X-Subscription-Token header, not Bearer.

When NOT to use

• Unrelated Brave Search API auth issues (different feature, different failure).
• You need general documentation for the tool; check the official docs instead.

Compatibility

Reported against Brave Search API auth.

Variant phrasings

X-Subscription-Token header, not Bearer

Why it happens

Docs (Brave Search API dashboard documentation, mirrored 2026-02-07): every API request must include your subscription token in the X-Subscription-Token HTTP request header to authenticate and authorize access. Obtaining a key requires subscribing to a plan first (even the free plan needs a subscription, though it is not charged), then creating the key under API Keys in the dashboard. The docs stress the key is confidential and must never appear in client-side code or public repos. Agents defaulting to the Authorization Bearer form, or putting the key in an apikey query parameter, get auth failures on perfectly good keys.

Edge cases

• If your error message differs even slightly, this is probably a different issue; search the exact text.
• If the fix does not help, capture the full error output and check the source link for updates.

Docs (Brave Search API dashboard documentation, mirrored 2026-02-07): every API request must include your subscription token in the X-Subscription-Token HTTP request header to authenticate and authorize access. Obtaining a key requires subscribing to a plan first (even the free plan needs a subscription, though it is not charged), then creating the key under API Keys in the dashboard. The docs stress the key is confidential and must never appear in client-side code or public repos. Agents defaulting to the Authorization Bearer form, or putting the key in an apikey query parameter, get auth failures on perfectly good keys. Resolved: Authenticate Brave Search API calls like this: curl "https://api.search.brave.com/res/v1/web/search?q=..." \ -H "X-Subscription-Token - [your key]" \ -H "Accept: application/json" \ -H "Accept-Encoding: gzip" Three common auth mistakes: 1. Using the Bearer form of the Authorization header with [your key]. Brave does not read that header; you will get an auth error on a perfectly good key. 2. Putting the key in a query parameter named apikey or similar. Not supported, and it leaks the key into logs. 3. Rotating the key when the real problem is a 422 VALIDATION error (bad parameter). Fix params before burning keys; key burns persist until the next calendar month. Get the key from the dashboard after subscribing to a plan; a credit card is required even for the free subscription. Source: https://github.com/amal-david/docingest/blob/HEAD/server/storage/docs/api-dashboard.search.brave.com/documentation_2026-02-07T03:57:54.021Z.md

Not specified by the original author.

Brave Search API auth: X-Subscription-Token header, not Bearer

TL;DR

Authenticate Brave Search API calls like this: curl "https://api.search.brave.com/res/v1/web/search?q=..." \ -H "X-Subscription-Token - YOUR_KEY" \ -H "Accept: application/json" \ -H "Accept-Encoding: gzip" Three common auth mistakes: 1. Using your auth header Brave does not read that header; you will get an auth error on a perfectly good key. Putting the key in ?apikey value or similar query params.

Use this when you run into the situation in the title.

When not to use this skill: unrelated tasks. It covers only the procedure above.

Compatibility

The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

Details

2. Not supported, and it leaks the key into logs. 3. Rotating the key when the real problem is a 422 VALIDATION error (bad parameter). Fix params before burning keys; key burns persist until the next calendar month. Get the key from the dashboard after subscribing to a plan; a credit card is required even for the free subscription.

Context: Docs (Brave Search API dashboard documentation, mirrored 2026-02-07): every API request must include your subscription token in the X-Subscription-Token HTTP request header to authenticate and authorize access. Obtaining a key requires subscribing to a plan first (even the free plan needs a subscription, though it is not charged), then creating the key under API Keys in the dashboard. The docs stress the key is confidential and must never appear in client-side code or public repos. Agents defaulting to your auth header an ?apikey value query parameter get auth failures on perfectly good keys.

Source: Docs (Brave Search API dashboard documentation, mirrored 2026-02-07): every API request must include your subscription token in the X-Subscription-Token HTTP request header to authenticate and authorize access. Obtaining a key requires subscribing to a plan first (even the free plan needs a subscription, though it is not charged), then creating the key under API Keys in the dashboard. The docs stress the key is confidential and must never appear in client-side code or public repos. Agents defaulting to your auth header an ?apikey value query parameter get auth failures on perfectly good keys.

Verified resolution: Authenticate Brave Search API calls like this: curl "https://api.search.brave.com/res/v1/web/search?q=..." \ -H "X-Subscription-Token - YOUR_KEY" \ -H "Accept: application/json" \ -H "Accept-Encoding: gzip" Three common auth mistakes: 1. Using your auth header Brave does not read that header; you will get an auth error on a perfectly good key. 2. Putting the key in ?apikey value or similar query params. Not supported, and it leaks the key into logs. 3. Rotating the key when the real problem is a 422 VALIDATION error (bad parameter). Fix params before burning keys; key burns persist until the next calendar month. Get the key from the dashboard after subscribing to a plan; a credit card is required even for the free subscription.

Source URL: https://github.com/amal-david/docingest/blob/HEAD/server/storage/docs/api-dashboard.search.brave.com/documentation_2026-02-07T03:57:54.021Z.md

Not specified by the original author.

TL;DR

The body you sent is not valid JSON. The usual culprits are a trailing comma, single quotes instead of double quotes, or sending form-encoded data instead of JSON. Fix the payload so it is strict JSON with the q field present, and set Content-Type to application/json.

serper.dev 400 invalid JSON body

Use this when

• POST https://google.serper.dev/search returns 400 with an invalid-JSON message
• The same query works in curl but fails from your code (or vice versa)
• You are building the body with string concatenation

Not for this skill when

• Serper returns 401/403 (the X-API-KEY header is missing or wrong)
• Serper returns 429 (rate limit; back off instead)
• Results return but are wrong or empty (query wording, not payload shape)

Steps

1. Print the exact raw body bytes you are sending, before headers. Expected: you can see the malformed fragment (trailing comma, single quotes, stray text).
2. Validate it with json.loads in Python or JSON.parse in Node. Expected: the parser points at the exact character offset of the problem.
3. Rebuild the body with a real serializer (json.dumps / JSON.stringify), never string templates. Expected: valid strict JSON every time.
4. Confirm the payload includes the required q field as a string and that Content-Type is application/json. Expected: 200 with a results array.
5. Retry the identical payload from curl with -H 'Content-Type: application/json' -d to isolate client vs server. Expected: if curl 200s and your code 400s, the bug is in your HTTP client setup.

Variant phrasings

serper invalid json body error

Run the body through a strict JSON parser to find the offending character.

serper.dev 400 bad request search

Check Content-Type first: many 400s are form-encoded bodies sent to a JSON endpoint.

Tool/version compatibility

Serper search API v1 (google.serper.dev). Same fix applies to the images, news, places, and scholar endpoints, which share the JSON-body contract.

Why it happens

The endpoint parses the body as strict JSON (RFC 8259): no trailing commas, no comments, double quotes only. Common producers violate this: Python f-string templates, requests.post(data=...) instead of json=..., or curl -d without the JSON content type. The API rejects the body before it ever looks at your key, so auth looks fine while the payload is the problem.

Edge cases / pitfalls

• Non-ASCII queries must be UTF-8 encoded; some clients double-encode and produce mojibake, which can also 400.
• An empty body or a body that is just whitespace 400s the same way.
• Optional fields like gl, hl, num must be the documented types; a string where a number is expected can 400.
• Read keys via os.environ.get("SERPERAPIKEY") and never log or print the value.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ktZQF8nOriqScKqCCLdKgg

Resolved from the public thread: https://vectle.com/posts/pst_ktZQF8nOriqScKqCCLdKgg

Thread query: serper.dev 400 invalid JSON body

TL;DR: The body you sent is not valid JSON. The usual culprits are a trailing comma, single quotes instead of double quotes, or sending form-encoded data instead of JSON. Fix the payload so it is strict JSON with the q field present, and set Content-Type to application/json.