{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid or missing API key"
  }
}

# ❌ WRONG - Has "Bearer" prefix
Authorization: Bearer abc123def456

# ✅ CORRECT - No prefix
Authorization: abc123def456

import os

api_key = os.getenv('LENDFOUNDRY_LOS_API_KEY')

# Check for common issues
if api_key is None:
    print("❌ API key not set in environment")
elif api_key.startswith('Bearer '):
    print("❌ API key contains 'Bearer ' prefix - remove it")
elif ' ' in api_key:
    print("❌ API key contains spaces - check for copy/paste errors")
elif len(api_key) < 10:
    print("⚠️ API key seems too short - verify correct key")
else:
    print("✅ API key format looks correct")

curl -v -X POST "https://loc.demo.kendra.lendfoundry.com/v1/darbaan/back-office/rest/api/list-applications" \
  -H "Authorization: your-api-key-here" \
  -H "Content-Type: application/json" \
  -d '{"page": 1, "size": 1}'

{
  "error": {
    "code": "FORBIDDEN",
    "message": "Insufficient permissions",
    "details": "Your API key does not have permission to access this resource"
  }
}

{
  "error": {
    "code": "TOKEN_EXPIRED",
    "message": "JWT token has expired",
    "details": "Token expired at 2025-12-15T10:30:00Z. Request a new token."
  }
}

from datetime import datetime, timedelta
import requests
import os

class TokenManager:
    """Manage JWT tokens with automatic refresh."""
    
    def __init__(self):
        self.client_id = os.getenv('LENDFOUNDRY_LMS_CLIENT_ID')
        self.client_secret = os.getenv('LENDFOUNDRY_LMS_CLIENT_SECRET')
        self.base_url = "https://api.demo.lms.lendfoundry.com"
        self.token = None
        self.expires_at = None
    
    def get_valid_token(self):
        """Get valid token, refreshing if needed."""
        # Refresh 5 minutes before expiry
        if self.token and self.expires_at:
            if datetime.now() < self.expires_at - timedelta(minutes=5):
                return self.token
        
        return self._refresh_token()
    
    def _refresh_token(self):
        """Request new token from OAuth endpoint."""
        response = requests.post(
            f"{self.base_url}/oauth/token",
            data={
                "grant_type": "client_credentials",
                "client_id": self.client_id,
                "client_secret": self.client_secret
            }
        )
        response.raise_for_status()
        
        data = response.json()
        self.token = data["access_token"]
        self.expires_at = datetime.now() + timedelta(seconds=data.get("expires_in", 3600))
        
        return self.token

# Usage - always use get_valid_token() before requests
token_manager = TokenManager()
token = token_manager.get_valid_token()

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Invalid token format",
    "details": "Bearer token is malformed"
  }
}

Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

def validate_token_format(token):
    """Validate JWT token format."""
    import jwt
    
    # Check if it looks like a JWT (3 parts separated by dots)
    parts = token.split('.')
    if len(parts) != 3:
        print("❌ Invalid JWT format - should have 3 parts")
        return False
    
    # Decode without verification to check structure
    try:
        decoded = jwt.decode(token, options={"verify_signature": False})
        print(f"✅ Valid JWT structure")
        print(f"   Expires: {datetime.fromtimestamp(decoded.get('exp', 0))}")
        return True
    except Exception as e:
        print(f"❌ Invalid JWT: {e}")
        return False

{
  "error": {
    "code": "INVALID_CLIENT",
    "message": "Invalid client_id or client_secret"
  }
}

import os

client_id = os.getenv('LENDFOUNDRY_LMS_CLIENT_ID')
client_secret = os.getenv('LENDFOUNDRY_LMS_CLIENT_SECRET')

# Remove any accidental whitespace
client_id = client_id.strip() if client_id else None
client_secret = client_secret.strip() if client_secret else None

# Validate
if not client_id:
    print("❌ CLIENT_ID not set")
elif not client_secret:
    print("❌ CLIENT_SECRET not set")
else:
    print(f"✅ Credentials loaded")
    print(f"   Client ID length: {len(client_id)}")
    print(f"   Client Secret length: {len(client_secret)}")

class LendFoundryClient:
    """Unified client for LOS and LMS with correct authentication."""
    
    def __init__(self, los_api_key, lms_client_id, lms_client_secret):
        self.los_api_key = los_api_key
        self.lms_token_manager = TokenManager(lms_client_id, lms_client_secret)
    
    def call_los(self, endpoint, data):
        """Call Application Submission API (LOS)."""
        headers = {
            "Authorization": self.los_api_key,  # No Bearer prefix
            "Content-Type": "application/json"
        }
        return requests.post(
            f"https://loc.demo.kendra.lendfoundry.com/v1/darbaan{endpoint}",
            json=data,
            headers=headers
        )
    
    def call_lms(self, endpoint, method="GET", data=None):
        """Call Active Loan Servicing API (LMS)."""
        token = self.lms_token_manager.get_valid_token()
        headers = {
            "Authorization": f"Bearer {token}",  # Bearer prefix required
            "Content-Type": "application/json"
        }
        return requests.request(
            method,
            f"https://api.demo.lms.lendfoundry.com/v1{endpoint}",
            json=data,
            headers=headers
        )

class LMSApiClient:
    """LMS API client with automatic token refresh."""
    
    def __init__(self, client_id, client_secret):
        self.token_manager = TokenManager(client_id, client_secret)
    
    def request(self, method, endpoint, **kwargs):
        """Make request with automatic token refresh."""
        token = self.token_manager.get_valid_token()
        
        headers = kwargs.pop('headers', {})
        headers['Authorization'] = f'Bearer {token}'
        headers['Content-Type'] = 'application/json'
        
        response = requests.request(
            method,
            f"https://api.demo.lms.lendfoundry.com/v1{endpoint}",
            headers=headers,
            **kwargs
        )
        
        # If token expired mid-request, refresh and retry once
        if response.status_code == 401:
            error_data = response.json()
            if error_data.get('error', {}).get('code') == 'TOKEN_EXPIRED':
                token = self.token_manager._refresh_token()
                headers['Authorization'] = f'Bearer {token}'
                response = requests.request(
                    method,
                    f"https://api.demo.lms.lendfoundry.com/v1{endpoint}",
                    headers=headers,
                    **kwargs
                )
        
        return response

# ❌ NEVER DO THIS
API_KEY = "abc123def456"  # Hardcoded credentials

# ✅ USE ENVIRONMENT VARIABLES
import os
API_KEY = os.getenv('LENDFOUNDRY_LOS_API_KEY')

# ✅ OR USE SECRETS MANAGER
import boto3

def get_secret(secret_name):
    client = boto3.client('secretsmanager')
    response = client.get_secret_value(SecretId=secret_name)
    return response['SecretString']

API_KEY = get_secret('lendfoundry/los-api-key')

import logging
import requests
from http.client import HTTPConnection

# Enable debug logging
logging.basicConfig(level=logging.DEBUG)
HTTPConnection.debuglevel = 1

# Now requests will show full HTTP details
response = requests.post(url, headers=headers, json=data)

import jwt
from datetime import datetime

def debug_jwt_token(token):
    """Decode and display JWT token information."""
    try:
        # Decode without verification (for debugging only)
        decoded = jwt.decode(token, options={"verify_signature": False})
        
        print("=== JWT Token Debug ===")
        print(f"Subject: {decoded.get('sub', 'N/A')}")
        print(f"Issued At: {datetime.fromtimestamp(decoded.get('iat', 0))}")
        print(f"Expires At: {datetime.fromtimestamp(decoded.get('exp', 0))}")
        
        now = datetime.now()
        exp = datetime.fromtimestamp(decoded.get('exp', 0))
        
        if now > exp:
            print(f"⚠️ TOKEN EXPIRED {now - exp} ago")
        else:
            print(f"✅ Token valid for {exp - now}")
        
        return decoded
    except Exception as e:
        print(f"❌ Failed to decode token: {e}")
        return None

# Usage
debug_jwt_token(your_jwt_token)

curl -v -X POST "https://loc.demo.kendra.lendfoundry.com/v1/darbaan/back-office/rest/api/list-applications" \
  -H "Authorization: your-api-key" \
  -H "Content-Type: application/json" \
  -d '{"page": 1, "size": 1}'