401 Unauthorized: The request is not from an authorized source when using HERE APIs

Applies To:

Trusted Domains Configuration
HERE Maps API for JavaScript (v3.x)
HERE Location Services APIs
REST API integrations using API Keys

Symptoms / Triggers:
--------------------

Customers may experience one or more of the following:

HTTP 401 Unauthorized response from HERE APIs.
Error message:

<br /> The request is not from an authorized source<br />
API requests work previously but start failing after Trusted Domains are configured.
Requests sent from Postman, curl, backend tools, or custom applications return authorization errors.
Browser developer tools show unauthorized requests when loading maps.
Maps fail to render or location service requests do not return results.
Requests succeed from one domain but fail from another domain.

Summary:
--------

A 401 Unauthorized error stating"The request is not from an authorized source" typically occurs when HERE Trusted Domains protection is enabled and the incoming request origin does not match a configured trusted domain. The resolution is to ensure that the request includes an allowed origin or that the correct application domain is configured within Trusted Domains settings.

Answer:
-------

This behavior is expected when Trusted Domains are enabled and the request does not originate from an approved domain. Update the Trusted Domains configuration to include the correct application domain or ensure the request contains the appropriate Referer value that matches an authorized domain.

For browser applications using the HERE Maps API for JavaScript, the browser controls the Referer header and it cannot be manually overridden by the application. The website hosting the application must be deployed on a valid domain that is configured in Trusted Domains.

Impact:
-------

### What Works

Requests originating from configured Trusted Domains.
Correctly deployed web applications using approved domains.
Server-side requests that satisfy Trusted Domain requirements.

### What Breaks

Requests from unapproved domains.
Requests executed from environments not configured in Trusted Domains.
Browser applications deployed under different domains than those configured for the API key.
Test environments that do not match the authorized domain configuration.

Recommended Actions:

Turned-on feature of the trusted domain and the missing referer in API requests

For example, I have the following trusted domain settings at https://platform.here.com/access/apps/my_app_id > Trusted Domains

The solution is adding the trusted domain value to the referer header of API requests

For Maps API for JavaScript, you cannot manipulate the "referer" of your API request as it will be refused by HERE.

Please deploy your web app on a website with a public domain and configure the real domain name to the Trusted Domain settings.

Note:

You can manipulate the Referer header of API requests but cannot do it for the HERE Maps API for JavaScript (Web SDK).

You must configure the domain name, on which you implemented the Maps API, to the Trusted Domain if you turned it on.

Reference Info or Documentation:
--------------------------------

* https://www.here.com/docs/bundle/identity-and-access-management-developer-guide/page/topics/plat-using-apikeys.html#trusted-domains

Keywords or Tags:
-----------------

401 Unauthorized, authorized source, trusted domain, Maps API JavaScript, Referer header, authentication, domain restriction, map not loading, access denied, request blocked