query_token_not_allowed

The API key was sent in the URL of a REST request; keys in the URL are accepted only for WebSockets.

HTTP 401. Nothing reached the broker.

Likely cause: A REST call carried ?api_key= or ?auth-token= in its query string. URLs end up in logs, browser history and proxies.

What to do: Send the key in the X-API-Key header (or auth-token, or Authorization: Bearer).

Retry: No. The same request gets the same answer; change something first.

Listed under Keys, tokens and permissions in Errors. Send the error’s requestId to support and we can find the request.