Search is throwing 401 error with search-only API key

[elhe26]

Description

When searching with a restricted API key, sometimes it returns a 401 error, and sometimes the actual response.

{
    "message": "Forbidden - a valid `x-typesense-api-key` header must be sent."
}

Steps to reproduce

const response = await client.keys().create({
  actions: ['documents:search', 'documents:get'],
  collections: ['*'],
  description: 'Search only key'
})

Expected Behavior

{
    "results": [
        {
            "facet_counts": [],
            "found": 0,
            "hits": [],
            "out_of": 0,
            "page": 1,
            "request_params": {
                "per_page": 10,
                "q": "Mark"
            },
            "search_time_ms": 0
        }
    ]
}

Actual Behavior

Erratic behavior:

• The 401 unauthorized response.
• Actual response.

Metadata

Typsense Version: typesense-server-0.22.1

OS: OS: Ubuntu 20.04 (LTS) x64

[kishorenc]

@elhe26 I just tried creating an API key with those exact permissions and tried hitting both search and individual document get end-point, and everything works as expected for me. Are you able to find any additional patterns on when the 401 is received? You can perhaps try logging them and see if there is a pattern to those failures.

[JayabharathiP]

For a valid API key typesense throws "Forbidden - a valid x-typesense-api-key header must be sent." error.

Here are the configurations
Added 2 nodes configuration for typesense.
Created a search only APIKey. Then created a scoped API key.

Note:
If I try to search again with the same scoped key it is working without issue.

Is there any specific configuration available for typesense multi node?

[kishorenc]

Does the error happen when you use scoped API key or the search-only API key?

Is there any specific configuration available for typesense multi node?

Make sure that the nodes are actually clustered and are not stand-alone. If they are not clustered, then key created on one node won't be available on the other. You can hit the /keys end-point to check that the same key exists on both nodes.