Unauthorized: Error getting User certificate" in Sandbox

Support
,
1

Hey everyone! :waving_hand:
I’m new here and working on my very first API project using the Fireblocks Developer Sandbox. I’m 17, just starting out in the API security and bug bounty world (I’m a researcher on HackerOne too – trying to learn by doing ).

So I set up the Fireblocks Postman collection, created an API user, added the API key and private key (copied properly from .key file), and set the environment variable baseUrl to:

https://sandbox-api.fireblocks.io/v1

Also selected the Boilerplate Fireblocks Environment and everything looks good… but every single request I make returns this:

{
“message”: “Unauthorized: Error getting User certificate”,
“code”: -7
}

I followed all the steps from the quickstart and the Postman setup guide. Even rechecked the JWT pre-request script, and it’s generating something – just not working with the API.

:test_tube: What I tried:

Made sure I'm in Developer Sandbox

Regenerated secret & API key

Pasted private key correctly (starts with -----BEGIN PRIVATE KEY-----)

Checked no duplicates of variables

Double-checked base URL

Tested with a new API user too

Still stuck — this is my first real hands-on attempt with an enterprise-level API and I’d love to understand what I might be doing wrong.

Any help from the awesome folks here would be really appreciated! related topics here.

2

Hi 10zxz01,
Nice to meet you,

Unauthorized: Token was not accepted
This error code typically indicates the JSON Web Token (JWT) supplied with the API user’s request was not accepted. API requests to Fireblocks are authenticated using the provided JWT. If the JWT is invalid, you will receive the error code. The cause of the error is likely either the wrong API key being used or the wrong baseURL being used.

For SDK users, this typically means an incorrect API key was used to create the client. For users with native API client implementations, this typically indicates an error with your JWT creation logic.

Please make sure that when you created the API user via the console you have used the correct CSR generated.

I would recommend creating a new API user from scratch and generating a new CSR + private key according to - https://support.fireblocks.io/hc/en-us/articles/4407823826194-Adding-new-API-Users. Once done please please update the postman variables, Private key + API key and let me know if that works out for you