"Invalid credentials" when posting a status to a Pleroma instance

[jncosideout]

I am switching from another JS library for the mastodon api called Tusk.
I am using the same access token I was granted for my pleroma instance and it is still valid, yet I am getting "Invalid credentials" when I use the Masto library and try to post a status or call verify_credentials.

Is Masto,js incompatible with Pleroma completely?

For what it's worth, I found this documentation explaining some differences between the mastodon and pleroma apis
It looks like pleroma uses the POST method. Could that make a difference?

And this is anecdotal, but to get the Tusk library to work for me on a pleroma instance, I had to set a parameter to force tusk to send a multipart form request instead of a url query, in order to post a status. That leads me to believe the http method may be different for pleroma vs mastodon.

Thanks for any help or guidance.

[jncosideout]

OK I think I found that "create" actions are always POSTed https://github.com/neet/masto.js/blob/main/src/adapters/action/dispatcher-http.ts

So if POST is the required method for Pleroma to create a status, then that must not be the problem.

I'll see if I can apply a custom header to set "Content-type" = "multipart/form-data" in my request, and see if that fixes it like it did with the Tusk lib.
It looks like I can add headers via a RequestInit in a HttpMetaParams json object as a 2nd param to the StatusesResource.create function

[jncosideout]

Setting multipart/form-data header in my request didn't work. Neither did setting encoding to multipart-form

Here are headers from a response I'm getting when I get the error MastoHttpError: Invalid credentials.
(I removed my server's name from the CSP header blob value, for my privacy)

access-control-allow-credentials = 'true'
access-control-allow-origin = '*'
access-control-expose-headers = 'Link,X-RateLimit-Reset,X-RateLimit-Limit,X-RateLimit-Remaining,X-Request-Id,Idempotency-Key'
cache-control = 'max-age=0, private, must-revalidate'
Connection = 'keep-alive'
Content-Length = '32'
Content-Security-Policy = "upgrade-insecure-requests;script-src 'self' 'wasm-unsafe-eval' 'unsafe-eval';connect-src 'self' blob: ... wss://... https:;media-src 'self' https:;img-src 'self' data: blob: https:;default-src 'none';base-uri 'self';frame-ancestors 'none';style-src 'self' 'unsafe-inline';font-src 'self';manifest-src 'self';"
Content-Type = 'application/json; charset=utf-8'
Date = 'Sat, 13 Jun 2026 17:42:14 GMT'
permissions-policy = 'interest-cohort=()'
referrer-policy = 'same-origin'
Server = 'nginx/1.18.0 (Ubuntu)'
x-content-type-options = 'nosniff'
x-download-options = 'noopen'
x-frame-options = 'DENY'
x-permitted-cross-domain-policies = 'none'
x-request-id = 'GLi04bnNn_Gl3KeBanAM'
x-xss-protection = '1; mode=block'

Here's what my code looks like:

const masto = createRestAPIClient({
    url: instance_url,
    access_token: access_token,
    timeout: 60*1000,  // optional HTTP request timeout in milliseconds to apply to all requests.
})

function post() {
    const statusParams = {
        status: "test 1",
        visibility: "direct"
    }

    const httpParams = {
        encoding : "multipart-form",
        requestInit: {
          headers: new Headers({ "content-type" : "multipart/form-data" }),
        }
    }
    
    masto.v1.statuses.create(statusParams, httpParams) //.$raw // raw isn't working for me
        .then( function (promiseObject) { ... }

I tried passing the httpParams with either the requestInit headers for "multipart/form-data" alone, or just the encoding : "multipart-form", or both together, none of those combinations helped.

[jncosideout]

here's how I can curl my Pleroma instance

# using form data
curl -X POST -H "Authorization: Bearer $myToken" \
    -F 'status=test1' \
    -F 'visibility=direct' \
   https://myPleromaSever.com/api/v1/statuses

# or json
curl -X POST -H "Authorization: Bearer $myToken" \
     -H 'Content-Type: application/json' \
    -d '{"status" : "test1", "visibility" : "direct"}'
   https://myPleromaSever.com/api/v1/statuses

I just tested both and they work on my Pleroma server using my auth token.
ℹ️ It isn't really my Pleroma server, I meant I have an account and app registered on a server.

[jncosideout]

ok I went down a rabbit hole on setting the multipart/form-data header, but it doesn't make a difference. Plus, I found out that no matter what custom data I put in a HttpMetaParams object, the encoding gets overwritten to application/json by dispatcher-http-hook-mastodon.inferEncoding if the request is "create."

But I know my real problem is "Invalid Credentials." So I cheated and modified your source to add my auth token into the request headers... and it worked!

Then I tested inserting my token into a custom auth header passed through a HttpMetaParams object, and that worked too.

While debugging, I found your function that merges custom headers into the request. And that is where I think I found the problem.
mergeHeadersWithDefaults sets the Auth header just like I did when I forced it, but it is pulling the access token property from props.accessToken. For me, the property was access_token and I that's because I instantiated my createRestAPIClient with { access_token: my_access_token }

So it was user error all along! (๑•́ω•̀๑)
Declaring it as accessToken fixed it.