使用PHP cURL调用REST API遭遇授权拒绝问题求助

首次使用PHP cURL调用账单/薪资/验证类REST API，需按规范POST提交员工服务验证数据，但始终收到"Authorization Denied"的403 Forbidden错误。API文档明确要求api_key类型的请求头认证，已尝试多种请求头配置仍未解决，请求协助排查。

API安全规范（OpenAPI片段） #

"security": [{"api_key": [] } ]

"headers": {},
"securitySchemes": {
    "api_key": {
        "type": "apiKey",
        "name": "api_key",
        "in": "header"
    }
}

我的PHP cURL代码 #

$post_data = json_encode($objTemplate);
$crl = curl_init('https://api.someapitestsite.io/submitter/06700809/');
curl_setopt($crl, CURLOPT_RETURNTRANSFER, true);
curl_setopt($crl, CURLINFO_HEADER_OUT, true);
curl_setopt($crl, CURLOPT_POST, true);
curl_setopt($crl, CURLOPT_POSTFIELDS, $post_data); 
curl_setopt($crl, CURLOPT_HTTPHEADER, array(
'Content-Type: application/json',
'type : apiKey',
'name : api_key',
'api_key: [-api--key--goes--here-]' ) );
curl_setopt($crl, CURLOPT_HEADER, 1);
$result = curl_exec($crl);
$result = curl_exec($ch); // 变量错误，应为$crl
if ($result == false)
    echo $crl;
curl_close($ch); // 变量错误，应为$crl
echo($result);

返回的授权拒绝信息 #

HTTP/1.1 403 Forbidden
Server: nginx
Date: Tue, 14 Feb 2023 16:17:04 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
Response-Token: 51b9e9c4-eb6f-46c7-9294-2a75a84eebe2
Vary: Origin
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
X-Ratelimit-Limit: -1
X-Ratelimit-Remaining: 0
X-Ratelimit-Reset: 0
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubdomains
X-Frame-Options: sameorigin
Content-Security-Policy: default-src 'self'
data: https://styles.transcend.csra.io ; script-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self'
data: https://styles.transcend.csra.io https://images.unsplash.com/ https://source.unsplash.com/; style-src 'self' 'unsafe-inline' https://styles.transcend.csra.io https://fonts.googleapis.com/; font-src 'self' https://fonts.googleapis.com/ https://fonts.gstatic.com; connect-src 'self' 'unsafe-inline' https://api.someapitestsite.io/; frame-ancestors 'self';
{"errors":[{"errorCode":"4070","errorMessage":"Authorization denied. Please contact  Operations Support."}]}

已尝试的请求头配置 #

// 尝试1
'security'=>'api_key: [-api--key--goes--here-]',
'Authorization'=>'api_key: [-api--key--goes--here-]'

// 尝试2
'Authorization' =>  'basic [-api--key--here-]'

// 尝试3
'api_key = [-api--key--here-]'

排查建议 #

• 修正代码变量错误：原代码中初始化的cURL句柄是$crl，但后续错误使用了未定义的$ch，导致请求执行异常。需将curl_exec($ch)和curl_close($ch)全部改为$crl。
• 简化请求头：根据API规范，仅需在请求头中添加api_key: 你的实际密钥，不需要type、name这类文档定义字段。正确的请求头配置应为：

  curl_setopt($crl, CURLOPT_HTTPHEADER, array(
      'Content-Type: application/json',
      'api_key: 你的真实密钥' // 去掉多余的括号，直接填写密钥
  ));
  

• 验证密钥有效性：确认密钥无复制错误（无多余空格、符号），且该密钥拥有访问目标接口的权限（比如是否为测试环境密钥但调用了生产接口）。
• 检查请求URL：确认URL路径正确，部分API对路径末尾的斜杠敏感，可尝试去掉末尾/测试。
• 开启cURL错误调试：在curl_exec后添加错误检查，排查请求是否存在底层错误：

  if(curl_errno($crl)){
      echo 'CURL错误信息：' . curl_error($crl);
  }
  

• 确认实际发送的请求头：通过CURLINFO_HEADER_OUT获取实际发送的请求头，验证api_key是否正确携带：

  $sentHeaders = curl_getinfo($crl, CURLINFO_HEADER_OUT);
  echo '实际发送的请求头：' . $sentHeaders;
  

• 检查API限流状态：返回头中X-Ratelimit-Remaining: 0，需确认是否触发了限流，可联系API运营方确认限流规则。

内容的提问来源于stack exchange，提问作者brianH