使用PHP CURL调用OneSignal API指定included_segments时鉴权报错求助

问题现象 #

调用OneSignal API发送通知时，使用included_segments: ["Active Users"]参数会返回错误：

Please include a case-sensitive header of Authorization: Basic or Bearer token="" with a valid REST API key.

但切换为include_player_ids参数时，代码能正常运行，需解决included_segments的使用问题。

排查与解决方案 #

1. 用json_encode生成请求体，避免手动拼接JSON错误 #

手动拼接JSON时易出现转义格式问题，导致API解析请求失败，进而误报授权异常。改用json_encode构造请求数据，能确保JSON格式完全合规：

function Copts($titlEN,$titlAR,$contEN,$contAR,$icon,$img){
    $postData = [
        "app_id" => "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
        "included_segments" => ["Active Users"],
        "contents" => ["en" => $contEN],
        "headings" => ["en" => $titlEN],
        "global_image" => $img,
        "large_icon" => $icon
    ];

    $curl = curl_init();

    curl_setopt_array($curl, array(
        CURLOPT_URL => 'https://onesignal.com/api/v1/notifications',
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_ENCODING => '',
        CURLOPT_MAXREDIRS => 10,
        CURLOPT_TIMEOUT => 0,
        CURLOPT_FOLLOWLOCATION => true,
        CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
        CURLOPT_CUSTOMREQUEST => 'POST',
        CURLOPT_POSTFIELDS => json_encode($postData),
        CURLOPT_HTTPHEADER => array(
            'Content-Type: application/json; charset=utf-8',
            'Authorization: Basic xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
        )
    ));
 
    return json_decode(curl_exec($curl),true);
}

2. 确认授权头格式与API Key有效性 #

• 检查Authorization头：确保Basic后有且仅有一个空格，API Key无多余空格、换行或特殊字符；
• 验证API Key权限：登录OneSignal后台确认当前REST API Key拥有向Segments发送通知的权限（因include_player_ids可正常运行，此步骤大概率可跳过）。

3. 排查请求详情 #

若问题仍存在，可打印请求详情确认参数是否正确发送：

$response = curl_exec($curl);
var_dump(curl_getinfo($curl)); // 输出请求头、状态码等信息排查问题
return json_decode($response,true);

内容的提问来源于stack exchange，提问作者ertibi