Problem
The actors search command does not require authentication, but it currently fails with a 401 error if the user has an expired or revoked token stored in their auth file.
This happens because getApifyClientOptions() injects the stored token into the ApifyClient, and the API rejects the invalid token even though the endpoint doesn't require auth.
Context
Discovered during review of #1047 (comment).
Possible solutions
Quick fix — strip the token for commands that don't need auth:
const clientOptions = getApifyClientOptions();
delete clientOptions.token;
const client = new ApifyClient(clientOptions);
Proper fix — handle this at the getApifyClientOptions level, e.g. by adding an option to opt out of token injection, so all future non-auth commands benefit automatically.
Reproduction
- Store a fake/expired token: write
{"token": "fake-expired-token-12345"} to the auth file
- Run
apify actors search "web scraper"
- Command fails with 401 instead of returning results
Test case
describe('with expired/invalid token', () => {
useAuthSetup({ cleanup: true, perTest: true });
it('should still succeed when an invalid token is stored (no auth required)', async () => {
const authPath = AUTH_FILE_PATH();
mkdirSync(dirname(authPath), { recursive: true });
writeFileSync(authPath, JSON.stringify({ token: 'fake-expired-token-12345' }));
await testRunCommand(ActorsSearchCommand, {
args_query: 'web scraper',
flags_json: true,
flags_limit: 1,
});
expect(process.exitCode).toBeUndefined();
const output = lastLogMessage();
const parsed = JSON.parse(output);
expect(parsed).toHaveProperty('items');
});
});
Problem
The
actors searchcommand does not require authentication, but it currently fails with a 401 error if the user has an expired or revoked token stored in their auth file.This happens because
getApifyClientOptions()injects the stored token into theApifyClient, and the API rejects the invalid token even though the endpoint doesn't require auth.Context
Discovered during review of #1047 (comment).
Possible solutions
Quick fix — strip the token for commands that don't need auth:
Proper fix — handle this at the
getApifyClientOptionslevel, e.g. by adding an option to opt out of token injection, so all future non-auth commands benefit automatically.Reproduction
{"token": "fake-expired-token-12345"}to the auth fileapify actors search "web scraper"Test case