You need to make sure your Token has the correct synced permissions. if you make changes to permissions after install you need to get a new token, i would recommend to generate a new token (uninstall/reinstall app from merchant)

Thanks for the help, bryanvargas. I posted another topic, HERE, and parquet76 is saying I don't need to create and app. Is that true? You can read in that topic what my situation is... I am trying to integrate Clover payments into my client's ecommerce site, using Hosted iframe to process payments.

So, regarding what you said re: permissions and getting a new token... parquet76 is saying generate an ecommerce token from the Test Merchant. I have done that, and the system doesn't allow any setting of permissions for an ecommerce token.

If you are talking about an "API Token" and not an "Ecommerce API Token", then yes, I can try that now as you say, delete the token, then create a new token, setting the permissions in that step. I don't think it's necessary to uninstall and then reinstall the app, correct? Again, parquet76 says I don't need an app.

thanks again for your help.

Just got this while trying to reply with more information... attack detected? !!

I just created a new API Token for the Test Merchant, giving it full permissions.

Then I tried this...

curl --request GET \
--url https://sandbox.dev.clover.com/v3/merchants/RCTSTAVI0010002 \
--header 'accept: application/json' \
--header 'authorization: Bearer 5963a4a9-d903-bdbb-b6f7-d472cd14358e'

which returns "401 Unauthorized", both when I tried it from HERE and from my server.

I will now delete the app from Test Merchant and reinstall the app. I doubt it will have any effect.

UPDATE: Nope, doesn't work. I have three API Tokens now for Test Merchant: all read, all write, and both all read/write. None of them work.

Whatever the case here, I am onto trying to set up an interactive form with HTML and javascript, in order to get a card token and create a charge, in the sandbox. See my other thread HERE.

Then I also need help creating an OAuth auth_token, to do the same test in the live environment.

I'm now trying to write some code that will accomplish that, I think... see my thread in the link.

So it turns out I don't need an OAuth token. See details HERE.

Hello,

I understand your frustration with receiving a "401 Unauthorized" error while testing the REST API in the sandbox. It seems like you're encountering an authentication issue despite following all the necessary steps. One potential solution is to double-check your API token and ensure that it hasn't expired or that there are no additional headers required for authentication. Also, verify that you're using the correct environment (sandbox vs. production) URLs. In a similar vein, I faced a similar issue when integrating APIs for the gogoanime app, and the problem was resolved by re-generating the API token and ensuring the permissions were correctly set. Making a screen recording might indeed help pinpoint the issue more effectively.

Thanks!