# API Integration **URL:** \ **Category:** API Issues\ **Created:** [September 24, 2026, 3:01pm UTC](http://forum.companieshouse.gov.uk/t/api-integration/13027 "2026-09-24T15:01:14Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![dmasconsul](http://forum.companieshouse.gov.uk/letter_avatar_proxy/v4/letter/d/c57346/32.png) [@dmasconsul](http://forum.companieshouse.gov.uk/u/dmasconsul)\ **Post date:** [September 24, 2026, 3:01pm UTC](http://forum.companieshouse.gov.uk/t/api-integration/13027/1 "2026-09-24T15:01:14Z")
I am experiencing an authentication issue with a newly created **Live REST API key**. **Application:** DMAS Lead Generation **Environment:** Live **Key type:** REST API key **Restricted IPs:** None **JavaScript domains:** None I am trying to access the Companies House Public Data API using the documented HTTP Basic Authentication method, with the API key as the username and a blank password. Endpoint tested: `https://api.company-information.service.gov.uk/company/17145528` I have tested the key independently using Windows `curl.exe`, not just through my application. The request follows the documented format: `curl -i -u ":" -H "User-Agent: DMAS-Lead-Generation/1.0" https://api.company-information.service.gov.uk/company/17145528` The response is: **HTTP/1.1 400 Bad Request** `{"error":"Invalid Authorization header","type":"ch:service"}` The response headers also include: `Ch-Authentication-Error: Invalid Authorization header` I have: 1. Created a Live application. 2. Created a new REST API key. 3. Copied the key directly using the Developer Hub’s **Copy** function. 4. Tested the key using the documented Basic Authentication method. 5. Tested it independently using Windows `curl.exe`. 6. Confirmed there are no IP restrictions or JavaScript domain restrictions. 7. Generated a fresh key and received the same response. Could you please check whether the Live REST API key for this application/account has been correctly activated/provisioned, and advise if there is any additional activation or account approval step required? I would be grateful if you could also confirm whether there is currently an issue affecting newly generated Live REST API keys. I have not included the API key itself for security reasons. ---
**Author:** ![companieshousedata](http://forum.companieshouse.gov.uk/user_avatar/forum.companieshouse.gov.uk/companieshousedata/32/2190_2.png) [@companieshousedata](http://forum.companieshouse.gov.uk/u/companieshousedata)\ **Post date:** [September 24, 2026, 4:46pm UTC](http://forum.companieshouse.gov.uk/t/api-integration/13027/2 "2026-09-24T16:46:10Z")
I’ve tested the same request with my own Live REST API key and it succeeds. I also used `--config NUL` to avoid any local curl configuration and `--basic` to make the authentication scheme explicit. Could you try the following, replacing only the placeholder with your key? ```auto curl.exe --config NUL --basic --user "your-LIVE-key-here:" --header "Accept: application/json" --header "User-Agent: DMAS-Lead-Generation/1.0" --verbose "https://api.company-information.service.gov.uk/company/17145528" ``` Please check that there is no leading or trailing whitespace in the key and that the colon remains immediately after the key inside the quotes. Output from my test is below. It might be worth creating another live app and using a new key just to be sure. `curl -i -u "my-REST-API-KEY-was-here:" -H "User-Agent: DMAS-Lead-Generation/1.0" https://api.company-information.service.gov.uk/company/17145528` HTTP/2 200 **date** : Thu, 24 Sep 2026 15:19:24 GMT **content-type** : application/json **access-control-allow-credentials** : true **access-control-allow-headers** : X-RateLimit-Query, origin, content-type, content-length, user-agent, host, accept, authorization **access-control-expose-headers** : X-RateLimit-Window, X-RateLimit-Limit, X-RateLimit-Remain, X-RateLimit-Reset, Location, www-authenticate, cache-control, pragma, content-type, expires , last-modified **access-control-max-age** : 3600 **cache-control** : no-cache, no-store, max-age=0, must-revalidate **expires** : 0 **pragma** : no-cache **set-cookie** : JSESSIONID=I\_REMOVED\_THIS\_MANUALLY; Path=/; HttpOnly **x-content-type-options** : nosniff **x-frame-options** : DENY **x-ratelimit-limit** : 600 **x-ratelimit-remain** : 598 **x-ratelimit-reset** : 1790263458 **x-ratelimit-window** : 5m **x-xss-protection** : 0 {“accounts”:{“accounting\_reference\_date”:{“day”:“30”,“month”:“04”},“next\_accounts”:{“due\_on”:“2028-01-09”,“overdue”:false,“period\_end\_on”:“2027-04-30”,“period\_start\_on”:“2026-04-09” },“next\_due”:“2028-01-09”,“next\_made\_up\_to”:“2027-04-30”,“overdue”:false},“can\_file”:true,“company\_name”:“\“BIGHOUSE DIRECT LTD\” LTD”,“company\_number”:“17145528”,“company\_status”:" active",“confirmation\_statement”:{“next\_due”:“2027-04-22”,“next\_made\_up\_to”:“2027-04-08”,“overdue”:false},“date\_of\_creation”:“2026-04-09”,“etag”:“c31c070c408c2d6896c9516d1bfe393c459 6a0b0”,“has\_charges”:false,“has\_insolvency\_history”:false,“jurisdiction”:“england-wales”,“links”:{“persons\_with\_significant\_control”:“/company/17145528/persons-with-significant-cont rol”,“self”:“/company/17145528”,“filing\_history”:“/company/17145528/filing-history”,“officers”:“/company/17145528/officers”},“registered\_office\_address”:{“address\_line\_1”:“1 Rossall Avenue”,“country”:“United Kingdom”,“locality”:“Manchester”,“postal\_code”:“M26 1JD”},“registered\_office\_is\_in\_dispute”:false,“sic\_codes”:[“47910”],“type”:“ltd”,“undeliverable\_regist ered\_office\_address”:false,“has\_super\_secure\_pscs”:false}`