# GPT Actions, Bearer token authorization **URL:** \ **Category:** Plugins / Actions builders\ **Tags:** authentication, actions\ **Created:** [November 18, 2023, 11:22am UTC](https://community.openai.com/t/gpt-actions-bearer-token-authorization/511475 "2023-11-18T11:22:31Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![sefcik.simon](https://sea2.discourse-cdn.com/openai1/user_avatar/community.openai.com/sefcik.simon/32/433831_2.png) [@sefcik.simon](https://community.openai.com/u/sefcik.simon)\ **Post date:** [November 18, 2023, 11:22am UTC](https://community.openai.com/t/gpt-actions-bearer-token-authorization/511475/1 "2023-11-18T11:22:31Z")
I followed the OpenAPI guidelines on how to do the bearer token authorization or better how to define in the schema, but for some reason the GPT is unable to pass the access token (from uploaded txt when given instructions) during runtime to requests, so i am always getting 401… Thanks for any response ---
**Author:** ![xforward77](https://sea2.discourse-cdn.com/openai1/user_avatar/community.openai.com/xforward77/32/149288_2.png) [@xforward77](https://community.openai.com/u/xforward77)\ **Post date:** [November 18, 2023, 5:49pm UTC](https://community.openai.com/t/gpt-actions-bearer-token-authorization/511475/2 "2023-11-18T17:49:57Z")
Build your GPTs action and OAuth by this powerful GPTs: [https://chat.openai.com/g/g-dVQNBgzdG-appcreator](https://chat.openai.com/g/g-dVQNBgzdG-appcreator) ---
**Author:** ![kevon217](https://sea2.discourse-cdn.com/openai1/user_avatar/community.openai.com/kevon217/32/216460_2.png) [@kevon217](https://community.openai.com/u/kevon217)\ **Post date:** [February 5, 2024, 3:31pm UTC](https://community.openai.com/t/gpt-actions-bearer-token-authorization/511475/3 "2024-02-05T15:31:43Z")
I’ve been running into this issue as well. Any luck with resolving this on your end? ---
**Author:** ![SmartGPTSolutions](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@SmartGPTSolutions](https://community.openai.com/u/SmartGPTSolutions)\ **Post date:** [February 6, 2024, 8:38am UTC](https://community.openai.com/t/gpt-actions-bearer-token-authorization/511475/4 "2024-02-06T08:38:57Z")
You need to run it without authentificaiton through serverless function. ---
**Author:** ![VeitB](https://sea2.discourse-cdn.com/openai1/user_avatar/community.openai.com/veitb/32/712987_2.png) [@VeitB](https://community.openai.com/u/VeitB)\ **Post date:** [February 6, 2024, 8:58am UTC](https://community.openai.com/t/gpt-actions-bearer-token-authorization/511475/5 "2024-02-06T08:58:27Z")
You are likely not implying to include the API key/token into the specification. Because that would be a huge security issue. The biggest advantage of the current implementation is that OpenAI is storing the API keys encrypted on their side. And they provide the audited documentation with regards to safety and security. When you say ‘severless function’ in the context of building GPTs via the ChatGPT interface, does your service offer the same level of security? Regarding the original question; Often these cases, where the bearer auth doesn’t work as expected, can be resolved by setting the method to ‘Custom’ and then defining the name in the OpenAPI specification. ---
**Author:** ![SmartGPTSolutions](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@SmartGPTSolutions](https://community.openai.com/u/SmartGPTSolutions)\ **Post date:** [February 6, 2024, 9:02am UTC](https://community.openai.com/t/gpt-actions-bearer-token-authorization/511475/6 "2024-02-06T09:02:19Z")
You do a public no key endpoint to the serverless function, and that function does the auth with the endpoint you wanted to go to. You basically add one layer extra. As i am building private GPTs i wont be subjected to some spam attack on my public serverless function endpoint that way. ---
**Author:** ![VeitB](https://sea2.discourse-cdn.com/openai1/user_avatar/community.openai.com/veitb/32/712987_2.png) [@VeitB](https://community.openai.com/u/VeitB)\ **Post date:** [February 6, 2024, 9:13am UTC](https://community.openai.com/t/gpt-actions-bearer-token-authorization/511475/7 "2024-02-06T09:13:49Z")
I see where you are coming from because sometimes it’s a real puzzle to call a API via Custom action. > [@SmartGPTSolutions](#): > > public no key endpoint Which implies that any person who could access a GPT today but maybe not tomorrow is still able to use the functionality publicly exposed without authentication. Would it not make sense to add a OAuth to ensure that only users with the respective rights can consume the API? At the end of the day it’s a priority to protect one’s access to connected services in order to not get banned or incur massive costs. ---
**Author:** ![SmartGPTSolutions](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@SmartGPTSolutions](https://community.openai.com/u/SmartGPTSolutions)\ **Post date:** [February 6, 2024, 9:16am UTC](https://community.openai.com/t/gpt-actions-bearer-token-authorization/511475/8 "2024-02-06T09:16:27Z")
If its a personalized GPT for non-technical user base, they are glad it works and wouldnt even have a clue how to abuse it. ---
**Author:** ![VeitB](https://sea2.discourse-cdn.com/openai1/user_avatar/community.openai.com/veitb/32/712987_2.png) [@VeitB](https://community.openai.com/u/VeitB)\ **Post date:** [February 6, 2024, 9:22am UTC](https://community.openai.com/t/gpt-actions-bearer-token-authorization/511475/9 "2024-02-06T09:22:53Z")
Look at it from this perspective: even non-technical users know how to log-in to services and why that’s important. I’d say, with regards to OP’s question a possible solution is to implement a second layer where the GPT contacts your own server and from there connects to the API as needed. As you are aware this can bring a whole lot of advantages to the table. Just make sure your server is properly secured. ---
**Author:** ![PaulBellow](https://sea2.discourse-cdn.com/openai1/user_avatar/community.openai.com/paulbellow/32/597962_2.png) [@PaulBellow](https://community.openai.com/u/PaulBellow)\ **Post date:** [September 19, 2024, 2:33pm UTC](https://community.openai.com/t/gpt-actions-bearer-token-authorization/511475/10 "2024-09-19T14:33:30Z")
A post was merged into an existing topic: [Bearer Token For Extensions](https://community.openai.com/t/bearer-token-for-extensions/947290/3)