[Bug]: error on sending notification to android devices using curl and php about new rich api introduced the 14/11/2024

[qasmmaoui]

What happened?

the latest api always retruns the same response {"errors": ["Access denied. Please include an 'Authorization: ...' header with a valid API key (https://documentation.onesignal.com/docs/accounts-and-keys)."]}

Steps to reproduce?

use url and latest version of rich api as mensioned in the docs ( used botyh key and Basic befor rich key )
curl --request POST \
     --url 'https://api.onesignal.com/notifications' \
     --header 'Authorization: Key NEW_RICH_KEY_API' \
     --header 'accept: application/json' \
     --header 'content-type: application/json' \
     --data '
{
  "app_id": "APP_ID",
  "target_channel": "push",
  "headings": {"en": "English Title", "es": "Spanish Title"},
  "contents": {"en": "English Message", "es": "Spanish Message"},
  "include_subscription_ids": [
    "SUBSCRIBER_ID"
  ]
}
'

(On the 14th of November 2024, we announced the new rich API key system described above and started deprecating legacy API keys. Legacy user API keys will be deprecated on the 1st of March 2025, and legacy app API keys will be deprecated in Q1 2026. We'll follow up with further communications closer to these dates.

To continue using the API, your apps need to migrate to using the new rich API keys described above. This migration is easy, and takes only a few minutes:

Follow the instructions above to create a new rich API key.
Update the key in your codebase so it uses the new rich key, removing the old legacy key.
Make sure your API requests are using https://api.onesignal.com and not the legacy https://onesignal.com/api/v1/ URL.
Click the "Disable Legacy Key" button in the app Keys & IDs page.)

What did you expect to happen?

receuve push on the emulator instead im revecing error on curl execution

OneSignal Android SDK version

5.1.21

Android version

15

Specific Android models

android emulator API 33

Relevant log output

{"errors": ["Access denied.  Please include an 'Authorization: ...' header with a valid API key (https://documentation.onesignal.com/docs/accounts-and-keys)."]}

Code of Conduct

• [X] I agree to follow this project's Code of Conduct

[jinliu9508]

Hello @qasmmaoui, it looks like you have Identity Verification turned on and when this option is on, an authorization token is required to complete the transactions. If you had this turned on by accident, you can turn it off by going to OneSignal Console -> Setting -> Key & IDs -> API Keys -> Required Identity Verification

[qasmmaoui]

hello @jinliu9508 thank you very much for your feedback , unfortunately its not enabled the only option i have mentioning identity validation is this Identity Verification for email + external_id (recommended) and its not enabled see attachement

[jinliu9508]

@qasmmaoui Could you confirm that you are are using the key from the app not the organization?

[qasmmaoui]

yes of course see attachmenet

[awilson9]

Having the exact same issue. Added a key, sending an API request and getting the exact same error. The key is valid, the cURL request follows the examples exactly

[irdaislakhuafa]

is there any progress regarding this bug? i am experiencing the same thing.

[mohit-2003]

I am also experiencing the same thing. Any updates?

[mohit-2003]

'included_segments' => ["Total Subscriptions"]

Total Subscriptions This solves my problem, when i put Subscribed Users, it shows error

[aqsaldpa]

'included_segments' => ["Total Subscriptions"]

Total Subscriptions This solves my problem, when i put Subscribed Users, it shows error

Did you still addressing the {"errors": ["Access denied. Please include an 'Authorization: ...' header with a valid API key (https://documentation.onesignal.com/docs/accounts-and-keys)."]} ?

Because i still addressing that problem and make me stuck. can u help me how u solve this key @mohit-2003 @jinliu9508 @qasmmaoui

[mohit-2003]

'included_segments' => ["Total Subscriptions"] Total Subscriptions This solves my problem, when i put Subscribed Users, it shows error

Did you still addressing the {"errors": ["Access denied. Please include an 'Authorization: ...' header with a valid API key (https://documentation.onesignal.com/docs/accounts-and-keys)."]} ?

Because i still addressing that problem and make me stuck. can u help me how u solve this key @mohit-2003 @jinliu9508 @qasmmaoui

The issue is resolved for me after sending "Total Subscriptions" in included_segments. Please send your code, may be i can help you.

[PRAFULDESHMUKH0435]

final requestBody = { 'app_id': oneSignalAppId, 'template_id': templateId, 'include_email_tokens': [email], 'included_segments': ['Total Subscriptions'], // ← Add this line 'custom_data': { 'name': name ?? 'Guest', 'email': email, }, 'include_unsubscribed': true, // optional for non-marketing emails }; i am still getting error can some one help if someone got resolved the above issue

[PRAFULDESHMUKH0435]

@mohit-2003 if u resolved your issue can u pls help with my code

[mohit-2003]

@mohit-2003 if u resolved your issue can u pls help with my code

This should work, it looks your problem depends on different factor.

Here is my code written in php, you can verify -

function sendNotificationViaOneSignal($message) {
        $onesignalAppId = 'your app id'; // Replace with your OneSignal App ID
        $onesignalApiKey = 'os_v2_app_api key'; // Replace with your OneSignal REST API Key
    
        $content = array(
            "en" => $message['body']
        );
    
        $fields = array(
            'app_id' => $onesignalAppId,
            'included_segments' => ["Total Subscriptions"], // Send to all users
            'headings' => array("en" => $message['title']),
            'contents' => $content,
            'data' => $message,
        );
    
        if ($message['image']) {
            $fields['big_picture'] = $message['image']; // Add image if available
        }
    
        $fields = json_encode($fields);
        
        log_message('error', 'OneSignal Notification - Payload: ' . print_r($fields, true));
        
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, "https://api.onesignal.com/notifications");
        curl_setopt($ch, CURLOPT_HTTPHEADER, array(
            'Content-Type: application/json; charset=utf-8',
            'Accept: application/json',
            'Authorization: Basic ' . $onesignalApiKey
        ));

        curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
        curl_setopt($ch, CURLOPT_HEADER, FALSE);
        curl_setopt($ch, CURLOPT_POST, TRUE);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $fields);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
    
        $response = curl_exec($ch);
        
          if (curl_errno($ch)) {
                log_message('error', 'OneSignal cURL Error: ' . curl_error($ch));
            } else {
                log_message('error', 'OneSignal Response: ' . $response);
            }

        curl_close($ch);
        $decodedResponse = json_decode($response, true);
       log_message('error', 'Decoded Response: ' . print_r($decodedResponse, true));
        return json_decode($response, true);
    } 

[wickedknock]

did not work, this is open for an year

[irdaislakhuafa]

did not work, this is open for an year

hi bro, have you try to use player_ids instead of include_subscription_ids? i use player_ids instead of include_subscription_ids and it's resolve my issue

[nan-li]

Hi all, it seems that people are running into different issues with the key and payload. Due to that, I am closing this out.

Please open a new issue with your specific details so we can look at each case individually.