# Stocks & Shares ISA — API key returns 401 Unauthorized on every request (3 fresh keys tried)

**URL:** <https://community.trading212.com/t/stocks-shares-isa-api-key-returns-401-unauthorized-on-every-request-3-fresh-keys-tried/93064>\
**Category:** 🤝 Help\
**Created:** [August 12, 2026, 10:53am UTC](https://community.trading212.com/t/stocks-shares-isa-api-key-returns-401-unauthorized-on-every-request-3-fresh-keys-tried/93064 "2026-08-12T10:53:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jwhittlestone](https://dub1.discourse-cdn.com/flex013/user_avatar/community.trading212.com/jwhittlestone/32/28397_2.png) [@jwhittlestone](https://community.trading212.com/u/jwhittlestone)\
**Post date:** [August 12, 2026, 10:53am UTC](https://community.trading212.com/t/stocks-shares-isa-api-key-returns-401-unauthorized-on-every-request-3-fresh-keys-tried/93064/1 "2026-08-12T10:53:19Z")

</div>

Hi all,

I’m trying to use the Public API against my **Stocks & Shares ISA** account and every request comes back `401 Unauthorized`, regardless of key, auth format, or client used. Hoping someone from the team or who’s hit this before can point me in the right direction, since there’s no support email for this.

**Setup:**

- Account: Stocks & Shares ISA
- Endpoints tried: `/api/v0/equity/account/cash`, `/api/v0/equity/account/info`
- Tested against both `live.trading212.com` and `demo.trading212.com` — same result on both

**What I’ve tried (all give an identical 401):**

- 3 separate keys generated fresh via Settings → API (Beta), the last with **every permission scope enabled**
- Auth header tried as: HTTP Basic (`base64(KeyID:Secret)`), Basic reversed (`base64(Secret:KeyID)`), bare Secret Key with no prefix, and `Bearer <Secret>`
- Confirmed no whitespace/encoding issues in the copied credentials
- Ruled out IP allowlisting (it’s off by default and I tested from two different networks)
- Reproduced with hand-written curl **and** with the [`trading212-api`](https://www.npmjs.com/package/trading212-api) npm client used exactly per its README — same 401 either way, so it’s not a client-side bug on my end

**Response details every time:**

- `401 Unauthorized`
- Body is just a single newline byte, no error message
- No `WWW-Authenticate` header
- Confirmed hitting the real backend, not a CDN/challenge page (`cf-cache-status: DYNAMIC`)

**CF-RAY IDs from failed requests** (happy to share timestamps/key ID via DM if that helps someone trace it server-side):  
`a2986357e8a5ecea-LHR`, `a2987fa5ed2d9498-LHR`, `a2987fa6ffb926c6-LHR`, `a29887ae7e8493f9-LHR`, `a29887af6ff050f1-LHR`, `a29d20686f7a60ea-LHR`, `a29d284eaf6f0c36-LHR`

**Question:** Is there an additional activation step for API access on ISA accounts beyond generating a key (e.g. does the key only work if generated while the account switcher is specifically on the ISA tab, or is there a beta enrollment gate separate from the Settings toggle)? Any pointers appreciated — thanks!

I signed up to trading212 specifically for this feature.

---

<div class="post-metadata">

**Author:** ![Sheepfoot](https://avatars.discourse-cdn.com/v4/letter/s/8491ac/32.png) [@Sheepfoot](https://community.trading212.com/u/Sheepfoot)\
**Post date:** [August 12, 2026, 5:17pm UTC](https://community.trading212.com/t/stocks-shares-isa-api-key-returns-401-unauthorized-on-every-request-3-fresh-keys-tried/93064/2 "2026-08-12T17:17:23Z")

</div>

I had a similar problem many months ago. First generate your secret codes again and as part of this process make sure you enable the endpoints you want to use.

For your first attempt, use one of the simplest API calls e.g. Account Info. Don’t forget the base64 conversion.

I submitted my secret codes via http headers. I’ve never used the parameter method. Be sure to use the correct header numbers.

That’s all I can think of at the mo.

---

<div class="post-metadata">

**Author:** ![jwhittlestone](https://dub1.discourse-cdn.com/flex013/user_avatar/community.trading212.com/jwhittlestone/32/28397_2.png) [@jwhittlestone](https://community.trading212.com/u/jwhittlestone)\
**Post date:** [August 13, 2026, 8:09am UTC](https://community.trading212.com/t/stocks-shares-isa-api-key-returns-401-unauthorized-on-every-request-3-fresh-keys-tried/93064/3 "2026-08-13T08:09:22Z")

</div>

Thanks - that worked.  
I had generated multiple keys during my attempts.  
Once i removed them all, and then regenerated a new one, it worked (using the quickstart in the docs)