# CakePHP 4 Auth token

**URL:** <https://discourse.cakephp.org/t/cakephp-4-auth-token/8191>\
**Category:** Uncategorized\
**Created:** [August 7, 2020, 12:50pm UTC](https://discourse.cakephp.org/t/cakephp-4-auth-token/8191 "2020-08-07T12:50:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rrd](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/rrd/32/113_2.png) [@rrd](https://discourse.cakephp.org/u/rrd)\
**Post date:** [August 7, 2020, 12:50pm UTC](https://discourse.cakephp.org/t/cakephp-4-auth-token/8191/1 "2020-08-07T12:50:42Z")

</div>

After deploying my app on the production server token authentication seems to fail.

The application is a REST API with a vuejs frontend.

The users can log in via login form and gets back an auth token. All later API calls authenticated with the token what is sent out in a header. On localhost everything work expected.

However at the production server token authentication fails, I get “no identity found” error.

Any idea what can cause this?

---

<div class="post-metadata">

**Author:** ![rrd](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/rrd/32/113_2.png) [@rrd](https://discourse.cakephp.org/u/rrd)\
**Post date:** [August 7, 2020, 2:09pm UTC](https://discourse.cakephp.org/t/cakephp-4-auth-token/8191/2 "2020-08-07T14:09:58Z")

</div>

It seems Apache swallowed the Authentication header, so it never reached my application.

To fix copy these lines into `.htaccess` and `webroot/.htaccess`

```auto
# Apache may swallow Authorization header
RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]

```

---

<div class="post-metadata">

**Author:** ![SyanCS](https://avatars.discourse-cdn.com/v4/letter/s/34f0e0/32.png) [@SyanCS](https://discourse.cakephp.org/u/SyanCS)\
**Post date:** [May 31, 2021, 11:03pm UTC](https://discourse.cakephp.org/t/cakephp-4-auth-token/8191/3 "2021-05-31T23:03:59Z")

</div>

you just saved me hours, thanks!