User api keys don't work in 3.0

[matart15]

Link to reproduction

No response

Payload Version

3.0.0-beta.82

Node Version

v20.12.2

Next.js Version

15.0.0-canary.104

Describe the Bug

fetch("http://localhost:3000/api/users", {
  headers: {
    Authorization: `users API-key 995f9aff-042d-4f4b-9890-088d2ca3517a`,
  },
});

result

{"errors":[{"message":"You are not allowed to perform this action."}]}

looks like it was working in may 1st by @fardeem. #6130

Now I cant make it work

my Users collection

import type { CollectionConfig } from 'payload'

import { authenticated } from '../../access/authenticated'

const Users: CollectionConfig = {
  slug: 'users',
  access: {
    admin: authenticated,
    create: authenticated,
    delete: authenticated,
    read: authenticated,
    update: authenticated,
  },
  admin: {
    defaultColumns: ['name', 'email'],
    useAsTitle: 'name',
  },
  // auth: true,
  auth: {
    useAPIKey: true,
    // disableLocalStrategy: true,
  },
  fields: [
    {
      name: 'name',
      type: 'text',
    },
  ],
  timestamps: true,
}

export default Users

Reproduction Steps

npx create-payload-app@latest
pnpm dev

Adapters and Plugins

No response

[gujral1997]

I am also getting this issue. I am unable to add/update user name.
I am also not able to update anything on the collection. I have deployed it on vercel. Only getting issue there. Things work fine locally.

[denolfe]

The header appears to be case-sensitive at the moment, can you try API-Key with a capital K and see if that changes behavior?

[benjosua]

@denolfe This does indeed solve the problem, thank you 🙌

[matart15]

Not working

curl http://localhost:3000/api/users \
  -H 'Authorization': users API-Key 995f9aff-042d-4f4b-9890-088d2ca3517a

Error message on dev server

 ○ Compiling /api/[...slug] ...
 ✓ Compiled /api/[...slug] in 7.1s (2938 modules)
[✓] Pulling schema from database...
[14:53:31] WARN: No email adapter provided. Email will be written to console. More info at https://payloadcms.com/docs/ema
il/overview.
[14:53:31] ERROR: Forbidden: You are not allowed to perform this action.
    at executeAccess (webpack-internal:///(rsc)/./node_modules/.pnpm/[email protected][email protected][email protected]
/node_modules/payload/dist/auth/executeAccess.js:16:39)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async findOperation (webpack-internal:///(rsc)/./node_modules/.pnpm/[email protected][email protected]_typescript
@5.5.4/node_modules/payload/dist/collections/operations/find.js:45:28)
    at async Object.find (webpack-internal:///(rsc)/./node_modules/.pnpm/@[email protected][email protected]_mon
[email protected][email protected]_pay_v47jxdfls4mmkbmlsoqzwgdkxa/node_modules/@payloadcms/next/dist/routes/rest/col
lections/find.js:15:20)
    at async eval (webpack-internal:///(rsc)/./node_modules/.pnpm/@[email protected][email protected]_monaco-edi
[email protected][email protected]_pay_v47jxdfls4mmkbmlsoqzwgdkxa/node_modules/@payloadcms/next/dist/routes/rest/index.js:2
74:35)
    at async /Users/matar/workplace/github/temp/payload-test/node_modules/.pnpm/[email protected][email protected]
[email protected]/node_modules/next/dist/compiled/next-server/app-route.runtime.dev.js:
6:65696
    at async eN.execute (/Users/matar/workplace/github/temp/payload-test/node_modules/.pnpm/[email protected]_react-d
[email protected][email protected]/node_modules/next/dist/compiled/next-server/app-route.run
time.dev.js:6:55802)
    at async eN.handle (/Users/matar/workplace/github/temp/payload-test/node_modules/.pnpm/[email protected]_react-do
[email protected][email protected]/node_modules/next/dist/compiled/next-server/app-route.runt
ime.dev.js:6:66997)
    at async doRender (/Users/matar/workplace/github/temp/payload-test/node_modules/.pnpm/[email protected]_react-dom
@[email protected]/node_modules/next/dist/server/base-server.js:1435:42)
    at async responseGenerator (/Users/matar/workplace/github/temp/payload-test/node_modules/.pnpm/[email protected]_
[email protected][email protected]/node_modules/next/dist/server/base-server.js:1682:
40)
    at async DevServer.renderToResponseWithComponentsImpl (/Users/matar/workplace/github/temp/payload-test/node_modules/.p
npm/[email protected][email protected][email protected]/node_modules/next/dist/
server/base-server.js:1721:28)
    at async DevServer.renderPageComponent (/Users/matar/workplace/github/temp/payload-test/node_modules/.pnpm/[email protected]
[email protected][email protected]/node_modules/next/dist/server/base-ser
ver.js:2058:24)
    at async DevServer.renderToResponseImpl (/Users/matar/workplace/github/temp/payload-test/node_modules/.pnpm/[email protected].
[email protected][email protected]/node_modules/next/dist/server/base-se
rver.js:2096:32)
    at async DevServer.pipeImpl (/Users/matar/workplace/github/temp/payload-test/node_modules/.pnpm/[email protected]
[email protected][email protected]/node_modules/next/dist/server/base-server.js:946:
25)
    at async NextNodeServer.handleCatchallRenderRequest (/Users/matar/workplace/github/temp/payload-test/node_modules/.pnp
m/[email protected][email protected][email protected]/node_modules/next/dist/se
rver/next-server.js:276:17)
    at async DevServer.handleRequestImpl (/Users/matar/workplace/github/temp/payload-test/node_modules/.pnpm/[email protected]
[email protected][email protected]/node_modules/next/dist/server/base-serve
r.js:839:17)
    at async /Users/matar/workplace/github/temp/payload-test/node_modules/.pnpm/[email protected][email protected][email protected]/node_modules/next/dist/server/dev/next-dev-server.js:378:20
    at async Span.traceAsyncFn (/Users/matar/workplace/github/temp/payload-test/node_modules/.pnpm/[email protected][email protected][email protected]/node_modules/next/dist/trace/trace.js:157:20)
    at async DevServer.handleRequest (/Users/matar/workplace/github/temp/payload-test/node_modules/.pnpm/[email protected][email protected][email protected]/node_modules/next/dist/server/dev/next-dev-server.js:375:24)
    at async invokeRender (/Users/matar/workplace/github/temp/payload-test/node_modules/.pnpm/[email protected][email protected][email protected]/node_modules/next/dist/server/lib/router-server.js:176:21)
    at async handleRequest (/Users/matar/workplace/github/temp/payload-test/node_modules/.pnpm/[email protected][email protected][email protected]/node_modules/next/dist/server/lib/router-server.js:353:24)
    at async requestHandlerImpl (/Users/matar/workplace/github/temp/payload-test/node_modules/.pnpm/[email protected][email protected][email protected]/node_modules/next/dist/server/lib/router-server.js:377:13)
    at async Server.requestListener (/Users/matar/workplace/github/temp/payload-test/node_modules/.pnpm/[email protected][email protected][email protected]/node_modules/next/dist/server/lib/start-server.js:142:13)

This works from browser i already logged in

fetch("http://localhost:3000/api/users", {
  headers: {
  },
});

[jmikrut]

Hey @matart15 you likely have another issue if you are indeed formatting your API-Key header correctly.

At this point, this is not an issue with Payload and is only an issue with your implementation. I will convert this to a discussion and we're happy to continue helping!

[matart15]

ok

[manutepowa]

Same request with JWT and API-Key.
With JWT it works.
With API-Key does not work

[manutepowa]

Wait a moment.
I have updated payload to beta-92 and API-Key works.

Nothing appears in the changelog.

[aestrro]

I haven't tried the new version but when useAPIKey is set to be true and I run into the:
ERROR: Forbidden: You are not allowed to perform this action.

I solve it by simply going to the user and validating the user (or whatever you name the collection) has an API-Key AND (the fix) is to see if the form is dirty - you can mouse over the save button and it may be pressable.

My theory is that generated API-Key that we often grab from the payload backend hasn't been submitted yet... Especially if we do enableAPIKey: true in our request to create a user...