Using HTTP Basic Auth on Nginx returning {"stat":"fail","err":401,"message":"Invalid api_key"} #2137

New Issue

2026-10-05T01:07:23+02:00

adam commented

2026-10-05 01:07:23 +02:00

Hi,
I have installed Piwigo 16 and using HTTP Basic Auth on Nginx (config "apache_authentication" is set to false).

HTTP Basic Auth is using for all member who wants to see albums without login to Piwigo (only 2 member have access to Piwigo administration for uploding albums).

In latest version - 16 - on all action in administration which is calling "ws.php" I get error:
{"stat":"fail","err":401,"message":"Invalid api_key"}
and I always get login form of HTTP Basic Auth.

In version 15 is this working.

Can be this fix?

Hi, I have installed Piwigo 16 and using HTTP Basic Auth on Nginx (config "apache_authentication" is set to false). HTTP Basic Auth is using for all member who wants to see albums without login to Piwigo (only 2 member have access to Piwigo administration for uploding albums). In latest version - 16 - on all action in administration which is calling "ws.php" I get error: `{"stat":"fail","err":401,"message":"Invalid api_key"}` and I always get login form of HTTP Basic Auth. In version 15 is this working. Can be this fix?

adam closed this issue

2026-10-05 01:07:23 +02:00

adam commented

2026-10-05 01:07:24 +02:00

YES this a major issue that now the API key is mandatory @plegall
For me it's blocking the Plugin Darktable to work (get list of albums for instance) and therefor all my schedule to post pictures while on holidays is compromised T_T

YES this a major issue that now the API key is mandatory @plegall For me it's blocking the Plugin Darktable to work (get list of albums for instance) and therefor all my schedule to post pictures while on holidays is compromised T_T

adam commented

2026-10-05 01:07:24 +02:00

Hello,

While waiting for the next release, if you want to stay in 16, you can make these changes in
include/user.inc.php line 69:

  if ($auth_header and preg_match('/^pkid-\d{8}-[a-z0-9]{20}:[a-z0-9]{40}$/i', $auth_header))

However, since you are using the Authorization header on the nginx side, you will not be able to use the Piwigo API with an API key unless you add this to your nginx configuration:

location = /ws.php {
    auth_basic off;
}

Hello, While waiting for the next release, if you want to stay in 16, you can make these changes in `include/user.inc.php` line 69: ```php if ($auth_header and preg_match('/^pkid-\d{8}-[a-z0-9]{20}:[a-z0-9]{40}$/i', $auth_header)) ``` However, since you are using the `Authorization` header on the nginx side, you will not be able to use the Piwigo API with an API key unless you add this to your nginx configuration: ```nginx location = /ws.php { auth_basic off; } ```

adam commented

2026-10-05 01:07:25 +02:00

@LintyDev I'm deeply stupid and please accept my apologies
I lost an hour for nothing trying to debug it, by reversing code after code just to identify that.......... Darktable had registered the wrong password ... to my defense, it's always displaying a green "Authenticated" message not matter what, because it seems Piwigo is sending a 200 code
I just reverted all files to v16 and it works well
sorry again.

@LintyDev I'm deeply stupid and please accept my apologies I lost an hour for nothing trying to debug it, by reversing code after code just to identify that.......... Darktable had registered the wrong password ... to my defense, it's always displaying a green "Authenticated" message not matter what, because it seems Piwigo is sending a 200 code I just reverted all files to v16 and it works well sorry again.

adam commented

2026-10-05 01:07:26 +02:00

@flop25 Ehh you're not stupid, and no problem! I hope you enjoy version 16 of Piwigo 😁

@flop25 Ehh you're not stupid, and no problem! I hope you enjoy version 16 of Piwigo 😁

adam commented

2026-10-05 01:07:27 +02:00

Thank you for the quick response and solution.
It works.

Thank you for the quick response and solution. It works.

adam commented

2026-10-05 01:07:27 +02:00

Notes:

We discussed the issue with plg. The initial conclusion was to have a custom header (e.g. X-PIWIGO-API). This would separate external authentications such as Basic Auth, which uses the Authorisation header, and Piwigo, which uses its custom header.

After reviewing how the Authorization header is normally used in HTTP and how other APIs handle API keys, we realized that mixing multiple authentication methods inside the same header quickly becomes confusing and creates unnecessary ambiguity.

The Authorization header is traditionally reserved for user-based credentials such as Basic Auth, Bearer tokens, or other schemes intended for "human" authentication. API keys, on the other hand, are usually provided through a separate dedicated header, which makes the intent explicit and avoids conflicts between authentication mechanisms.

This is particularly relevant for Piwigo.
There is no real benefit in sending both Basic Auth and an API key in the same header, because they represent two fundamentally different authentication models (user credentials vs. machine credentials).

During our discussion, plg highlighted an important point specific to Piwigo’s ecosystem: a user may intentionally rely on HTTP Basic Authentication at the server level (e.g., via Apache’s AuthType Basic) to fully block access to their gallery, preventing the photos from being displayed at all.
This is a valid and legitimate use case, and it reinforces the idea that Piwigo should not overload or reinterpret the Authorization header for multiple unrelated authentication types.

Notes: We discussed the issue with plg. The initial conclusion was to have a custom header (e.g. `X-PIWIGO-API`). This would separate external authentications such as `Basic Auth`, which uses the `Authorisation` header, and Piwigo, which uses its custom header. After reviewing how the `Authorization` header is normally used in HTTP and how other APIs handle API keys, we realized that mixing multiple authentication methods inside the same header quickly becomes confusing and creates unnecessary ambiguity. The `Authorization` header is traditionally reserved for user-based credentials such as `Basic Auth`, `Bearer tokens`, or other schemes intended for "human" authentication. API keys, on the other hand, are usually provided through a separate dedicated header, which makes the intent explicit and avoids conflicts between authentication mechanisms. This is particularly relevant for Piwigo. There is no real benefit in sending both Basic Auth and an API key in the same header, because they represent two fundamentally different authentication models (user credentials vs. machine credentials). During our discussion, **plg** highlighted an important point specific to Piwigo’s ecosystem: _a user may intentionally rely on HTTP Basic Authentication at the server level (e.g., via `Apache’s AuthType Basic`) to fully block access to their gallery, preventing the photos from being displayed at all._ This is a valid and legitimate use case, and it reinforces the idea that Piwigo should not overload or reinterpret the Authorization header for multiple unrelated authentication types.

Sign in to join this conversation.

master

issue-2560-people

translation

16.x

feat/embedding-based-contextual-tagging

issue-2576-search-include-ai-in-search-results

feat/search-ocr-ai

issue-2391-update-menu-design

15.x

detect-container

issue-2386-update-filters-users-activity

issue-2362-add-filters-options-in-admin

issue-2367-imagemagick7

issue-2225-quicksearch-help

14.x

issue-2164-BatchManagerUnitMode-Redesign

13.x

12.x

issue-1657-SVG_Support

issue-1703-historySearchMethod

11.x

2.10

2.9

2.8

2.7

2.5

2.6

2.4

2.3

2.2

2.1

2.0

1.7

1.3

1.6

1.5

1.4

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/Piwigo#2137