> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mixpanel.com/llms.txt
> Use this file to discover all available pages before exploring further.

# 401 Unauthorized

> Why Mixpanel's ingestion API returns a 401, which credentials each endpoint accepts, and how regional data residency affects authentication

A 401 means Mixpanel could not authenticate the request. The credentials were missing, malformed, or not valid for the project you addressed.

## What the Response Looks Like

From `/import`:

```json theme={"system"}
{
  "code": 401,
  "error": "Invalid credentials",
  "status": "Unauthorized"
}
```

## Which Credentials Each Endpoint Accepts

| Endpoint | Accepted credentials |
| - | - |
| `/import` | An Owner or Admin [Service Account](https://docs.mixpanel.com/reference/service-accounts.md) with `project_id`, a [Project Token](https://docs.mixpanel.com/reference/project-token.md) as the basic-auth username with an empty password, an OAuth token, or the deprecated [Project Secret](https://docs.mixpanel.com/reference/project-secret.md) |
| `/track`, `/engage`, `/groups` | A project token sent in the payload |

> [!NOTE]
>
> Don't rely on a 401 to catch a bad project token on `/track`. The endpoint can return `200` with a body of `1`, which confirms at least one object was well-formed but does not signify a valid project token or secret. Add `?verbose=1` to get a JSON response instead, and check your project's live view to confirm events are arriving.

## Common Causes

### Service Account Lacks the Required Role

`/import` requires an Owner or Admin Service Account. A Service Account with a lower role on the project can't import, even if its username and secret are correct.

### Missing `project_id`

When authenticating with a Service Account, `project_id` is required. Without it, Mixpanel cannot tell which project the credentials apply to.

### Wrong Regional Endpoint

Projects with EU or India data residency use different hosts. Send requests to the host that matches your project's residency.

| Residency | Host |
| - | - |
| US | `api.mixpanel.com` |
| EU | `api-eu.mixpanel.com` |
| India | `api-in.mixpanel.com` |

See [EU Residency](https://docs.mixpanel.com/docs/privacy/eu-residency.md) and [India Residency](https://docs.mixpanel.com/docs/privacy/in-residency.md).

### Malformed Basic Auth Header

Basic auth expects a base64-encoded `username:password` pair. A common mistake is encoding only the username, or omitting the colon when the password is empty.

## How to Fix It

**Confirm the credential type** matches what the endpoint accepts, using the table above.

**Check the Service Account's role** at Project Settings → Service Accounts. It must be Owner or Admin for `/import`.

**Verify your project's residency** and send to the matching host.

## Related

* [Service Accounts](https://docs.mixpanel.com/reference/service-accounts.md)
* [403 Forbidden](https://docs.mixpanel.com/troubleshooting/errors/403-forbidden.md)
* [Find your project token](https://docs.mixpanel.com/docs/orgs-and-projects/managing-projects.md#find-your-project-tokens)