# Authentication Header not found after activating authentication on the Daml on SQL Driver **URL:** \ **Category:** App Development\ **Created:** [February 24, 2021, 7:32am UTC](https://forum.canton.network/t/authentication-header-not-found-after-activating-authentication-on-the-daml-on-sql-driver/2147 "2021-02-24T07:32:26Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Darko](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/darko/32/42_2.png) [@Darko](https://forum.canton.network/u/Darko)\ **Post date:** [February 24, 2021, 7:32am UTC](https://forum.canton.network/t/authentication-header-not-found-after-activating-authentication-on-the-daml-on-sql-driver/2147/1 "2021-02-24T07:32:26Z")
After using the `--auth-jwt-rs256-jwks` argument to activate authentication on the Daml Driver, I’m getting the following log messages: ```haskell INFO: Initialized DAML-on-SQL version 1.9.0 with ledger-id = ..., port = ..., dar file = List(...), time mode = wall-clock time, ledger = postgres, auth-service = AuthServiceJWT, contract ids seeding = strong WARN: Authorization error: Authorization header not found ``` Can someone help me resolve the Warning? ---
**Author:** ![Darko](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/darko/32/42_2.png) [@Darko](https://forum.canton.network/u/Darko)\ **Post date:** [February 24, 2021, 7:37am UTC](https://forum.canton.network/t/authentication-header-not-found-after-activating-authentication-on-the-daml-on-sql-driver/2147/2 "2021-02-24T07:37:24Z")
This also happens with the sandbox. ---
**Author:** ![cocreature](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/cocreature/32/36_2.png) [@cocreature](https://forum.canton.network/u/cocreature)\ **Post date:** [February 24, 2021, 7:44am UTC](https://forum.canton.network/t/authentication-header-not-found-after-activating-authentication-on-the-daml-on-sql-driver/2147/3 "2021-02-24T07:44:07Z")
This error arises if your ledger client does not set the `Authorization` field in the gRPC metadata. Which Ledger Client are you using? For things like daml script, navigator, … we provide an `--access-token-file` flag which you can use here. ---
**Author:** ![Darko](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/darko/32/42_2.png) [@Darko](https://forum.canton.network/u/Darko)\ **Post date:** [February 24, 2021, 7:52am UTC](https://forum.canton.network/t/authentication-header-not-found-after-activating-authentication-on-the-daml-on-sql-driver/2147/4 "2021-02-24T07:52:57Z")
Is the health endpoint also protected? I.e. do I need a valid JWT to get a response from the health endpoint? ---
**Author:** ![stefanobaghino-da](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/stefanobaghino-da/32/7057_2.png) [@stefanobaghino-da](https://forum.canton.network/u/stefanobaghino-da)\ **Post date:** [February 24, 2021, 7:57am UTC](https://forum.canton.network/t/authentication-header-not-found-after-activating-authentication-on-the-daml-on-sql-driver/2147/5 "2021-02-24T07:57:17Z")
No, the health endpoint does not require a JWT. ---
**Author:** ![Darko](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/darko/32/42_2.png) [@Darko](https://forum.canton.network/u/Darko)\ **Post date:** [February 24, 2021, 8:03am UTC](https://forum.canton.network/t/authentication-header-not-found-after-activating-authentication-on-the-daml-on-sql-driver/2147/6 "2021-02-24T08:03:54Z")
We are investigating which client might be the culprit. Thanks! ---
**Author:** ![cocreature](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/cocreature/32/36_2.png) [@cocreature](https://forum.canton.network/u/cocreature)\ **Post date:** [February 24, 2021, 8:17am UTC](https://forum.canton.network/t/authentication-header-not-found-after-activating-authentication-on-the-daml-on-sql-driver/2147/7 "2021-02-24T08:17:29Z")
It looks like the reflection endpoint might require authorization so if you call the healthcheck endpoint via grpcurl, this might cause issues. ---
**Author:** ![stefanobaghino-da](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/stefanobaghino-da/32/7057_2.png) [@stefanobaghino-da](https://forum.canton.network/u/stefanobaghino-da)\ **Post date:** [February 24, 2021, 8:22am UTC](https://forum.canton.network/t/authentication-header-not-found-after-activating-authentication-on-the-daml-on-sql-driver/2147/8 "2021-02-24T08:22:40Z")
I don’t think it does, both health and reflection should be accessible without a JWT (looking at [this](https://github.com/digital-asset/daml/blob/09c46cf666184933e88167a7084d7906c6c55f7f/ledger/participant-integration-api/src/main/scala/platform/apiserver/ApiServices.scala#L168-L184) code). ---
**Author:** ![cocreature](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/cocreature/32/36_2.png) [@cocreature](https://forum.canton.network/u/cocreature)\ **Post date:** [February 24, 2021, 8:25am UTC](https://forum.canton.network/t/authentication-header-not-found-after-activating-authentication-on-the-daml-on-sql-driver/2147/9 "2021-02-24T08:25:03Z")
That’s odd, I definitely get an error if I try to call the healthcheck endpoint via grpcurl and I have authorization enabled. I don’t really see what other services it could call besides healthcheck and reflection. ---
**Author:** ![stefanobaghino-da](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/stefanobaghino-da/32/7057_2.png) [@stefanobaghino-da](https://forum.canton.network/u/stefanobaghino-da)\ **Post date:** [February 24, 2021, 8:32am UTC](https://forum.canton.network/t/authentication-header-not-found-after-activating-authentication-on-the-daml-on-sql-driver/2147/10 "2021-02-24T08:32:42Z")
Uh, then I must be looking at the wrong code. Apologies for the confusion. ---
**Author:** ![Darko](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/darko/32/42_2.png) [@Darko](https://forum.canton.network/u/Darko)\ **Post date:** [February 24, 2021, 8:41am UTC](https://forum.canton.network/t/authentication-header-not-found-after-activating-authentication-on-the-daml-on-sql-driver/2147/11 "2021-02-24T08:41:31Z")
Does that mean I need a similar JWT to the one from the JSON API? i.e. no `actAs`, `readAs`, or `admin` claims? It just needs to have the proper structure and signature? ---
**Author:** ![cocreature](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/cocreature/32/36_2.png) [@cocreature](https://forum.canton.network/u/cocreature)\ **Post date:** [February 24, 2021, 8:43am UTC](https://forum.canton.network/t/authentication-header-not-found-after-activating-authentication-on-the-daml-on-sql-driver/2147/12 "2021-02-24T08:43:01Z")
That should definitely work. However, if that is required I think there is a bug somewhere. You shouldn’t need authorization to call the healthcheck endpoint and I don’t think it makes sense for the reflection endpoint either. ---
**Author:** ![cocreature](https://yyz2.discourse-cdn.com/flex034/user_avatar/forum.canton.network/cocreature/32/36_2.png) [@cocreature](https://forum.canton.network/u/cocreature)\ **Post date:** [March 3, 2021, 8:46pm UTC](https://forum.canton.network/t/authentication-header-not-found-after-activating-authentication-on-the-daml-on-sql-driver/2147/13 "2021-03-03T20:46:19Z")
This turned out to be a bug which has since been fixed in the latest [1.11.0 snapshot](https://github.com/digital-asset/daml/releases/tag/v1.11.0-snapshot.20210303.6421.0.145ddaa8) as well as backported to version [1.10.2](https://github.com/digital-asset/daml/releases/tag/v1.10.2) of the Daml Driver for PostgreSQL.