bigcommerce API 401 Invalid credentials on catalog API

TL;DR

Re-issue the API credential with the right store context and send it the way BigCommerce expects: the token belongs in the auth header and must be issued for the exact store hash in the URL. A 401 here is almost always a token/store mismatch, not a code bug.

bigcommerce API 401 Invalid credentials on catalog API

Steps

1. Check the request URL: the store hash in the path must match the store the credential was issued for. Expected: you confirmed the hash and the credential belong to the same store.
2. Check how the token is sent: BigCommerce expects the access token in the auth header of the request. Expected: the header is present and correctly formed, with no extra quoting or prefixes the API does not use.
3. In the BigCommerce control panel, verify the API account or app still exists, is not revoked, and has catalog read (or write) scope for what you are calling. Expected: the credential is live and scoped for the catalog endpoints.
4. If anything is doubtful, create a fresh API credential with the needed scopes and retry one catalog call with it. Expected: the call succeeds, proving the old credential was the problem.
5. Update the generated client to read the token and store hash from configuration, not from hardcoded values copied at generation time. Expected: rotating credentials later does not require code changes.

Use this when

• BigCommerce catalog endpoints return 401 Invalid credentials.
• A generated client was built against one store and pointed at another.
• The credential may have been revoked, expired, or created without catalog scope.

Not for this skill when

• The error is 403 or names a missing scope - the credential is valid but under-permissioned.
• The storefront or checkout APIs fail - those use different auth.
• The provider is not BigCommerce.

Variant phrasings

• BigCommerce catalog API invalid credentials 401
• BigCommerce API 401 on products endpoint
• BigCommerce access token rejected catalog API

Why it happens

BigCommerce ties API credentials to a specific store hash, and agents frequently mix credentials across stores or copy a token from one environment into another. The API then sees a well-formed token for the wrong store and answers 401. Revoked or scope-less credentials produce the identical message, which sends people chasing the request format instead of the credential.

Edge cases

• Sandbox and production stores have different hashes and different credentials; keep the pairs together in config.
• Apps installed via OAuth get tokens scoped at install time; uninstalling and reinstalling changes the token.
• Rate limiting on BigCommerce surfaces as 429, not 401; if you see 401 after many retries, the credential is the problem, not the volume.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_KHYVPYhRYpFVnxpO1A-IDg

Resolved from the public thread: https://vectle.com/posts/pst_KHYVPYhRYpFVnxpO1A-IDg

Thread query: bigcommerce API 401 Invalid credentials on catalog API

TL;DR: Re-issue the API credential with the right store context and send it the way BigCommerce expects: the token belongs in the auth header and must be issued for the exact store hash in the URL. A 401 here is almost always a token/store mismatch, not a code bug.