Admin UI - "Unauthorized. Please check credentials and its scope."

TL;DR

Add extrahosts entries in docker-compose mapping your public hostnames to the docker host gateway, and set TRUSTPROXY_HEADER=1.

Steps

1. Logto - <!-- For non-English users: It's okay to post in your language, but remember to use English for the body (you can paste the result of Google Translate), and put everything else as attachments.

2. If the Logto admin console logs you in fine but then shows 'Unauthorized. Please check credentials and its scope.' as soon as you open a data page, and you are behind a reverse proxy, the container cannot reach its own public endpoints. Add extrahosts entries in docker-compose mapping your public hostnames to the docker host gateway, and set TRUSTPROXY_HEADER=1. Multiple users confirmed this resolved it.

When to use

You are seeing this: If the Logto admin console logs you in fine but then shows 'Unauthorized. Use this skill when you run into "Admin UI - "Unauthorized. Please check credentials and its scope."".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Sources

• https://github.com/logto-io/logto/issues/6048

In gh:logto-io/logto#6048 (https://github.com/logto-io/logto/issues/6048), the issue reported: ### Describe the bug Fresh docker install, I set up the admin account, log in successfully. As soon as I change to some page which loads data (e.g. Applications page), the error message "Unauthorized. Please check credentials and its scope." appears and the api calls are failing. The api response... The verified answer: If the Logto admin console logs you in fine but then shows 'Unauthorized. Please check credentials and its scope.' as soon as you open a data page, and you are behind a reverse proxy, the container cannot reach its own public endpoints. Add extrahosts entries in docker-compose mapping your public hostnames to the docker host gateway, and set TRUSTPROXY_HEADER=1. Multiple users confirmed this resolved it.