# 401 Unauthorized when switching Losant Endpoint Access Control to “Any Authenticated User”

**URL:** <https://forums.losant.com/t/401-unauthorized-when-switching-losant-endpoint-access-control-to-any-authenticated-user/5973>\
**Category:** Help\
**Tags:** experience, workflow, endpoint\
**Created:** [February 27, 2026, 11:30am UTC](https://forums.losant.com/t/401-unauthorized-when-switching-losant-endpoint-access-control-to-any-authenticated-user/5973 "2026-02-27T11:30:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Niels](https://avatars.discourse-cdn.com/v4/letter/n/ebca7d/32.png) [@Niels](https://forums.losant.com/u/Niels)\
**Post date:** [February 27, 2026, 11:30am UTC](https://forums.losant.com/t/401-unauthorized-when-switching-losant-endpoint-access-control-to-any-authenticated-user/5973/1 "2026-02-27T11:30:57Z")

</div>

Hi everyone,

I’m running into an issue when changing my Losant endpoint access control from **“All public users”** to **“Any authenticated user.”**

I have a simple endpoint: POST /events/add

On my dashboard, I’m using a Custom HTML block with a button that sends a payload: warning\_level: 5. See code below.

```auto
<div style="display:flex;gap:12px;align-items:center;">
  <button id="sendBtn" style="padding:10px 14px;cursor:pointer;">
    Send Warning Level 5
  </button>
  <span id="status" style="font-family:system-ui, sans-serif;"></span>
</div>

<script>
  const ENDPOINT_URL = "https://xxxxxxx.onlosant.com/events/add";

  const btn = document.getElementById("sendBtn");
  const statusEl = document.getElementById("status");

  btn.addEventListener("click", async () => {
    btn.disabled = true;
    statusEl.textContent = "Sending...";

    try {
      const res = await fetch(ENDPOINT_URL, {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        credentials: "include",
        body: JSON.stringify({ warning_level: 5 })
      });

      const text = await res.text();

      if (!res.ok) {
        statusEl.textContent = `Error ${res.status}: ${text || res.statusText}`;
      } else {
        statusEl.textContent = "✅ Sent: { warning_level: 5 }";
      }
    } catch (err) {
      statusEl.textContent = `Request failed: ${err.message}`;
    } finally {
      btn.disabled = false;
    }
  });
</script>

```

When access control is set to **“All public users”** , everything works as expected. The payload is received in the workflow.

When I change it to **“Any authenticated user”** , I receive: Error 401: {“statusCode”:401,“error”:“Unauthorized”}. Nothing is received in the workflow.

It appears that the authentication credentials are not being sent (or not recognized) when the endpoint requires authentication. Does anyone knows a solution?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![Dylan\_Schuster](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/dylan_schuster/32/2850_2.png) [@Dylan\_Schuster](https://forums.losant.com/u/Dylan_Schuster)\
**Post date:** [February 28, 2026, 8:47pm UTC](https://forums.losant.com/t/401-unauthorized-when-switching-losant-endpoint-access-control-to-any-authenticated-user/5973/2 "2026-02-28T20:47:46Z")

</div>

See this section of the [documentation on Custom HTML Blocks](https://docs.losant.com/dashboards/blocks/custom-html/#fetching-data-from-an-experience-endpoint); I’m guessing that is your issue. You will need to adjust the workflow that issues your user token (i.e. your login flow) to set the SameSite cookie policy to “None” to allow the cookie to be included in the request, as well as some minor adjustments to your block code.

---

<div class="post-metadata">

**Author:** ![Niels](https://avatars.discourse-cdn.com/v4/letter/n/ebca7d/32.png) [@Niels](https://forums.losant.com/u/Niels)\
**Post date:** [March 2, 2026, 10:54am UTC](https://forums.losant.com/t/401-unauthorized-when-switching-losant-endpoint-access-control-to-any-authenticated-user/5973/3 "2026-03-02T10:54:41Z")

</div>

Thanks Dylan!

Setting the SameSite policy to None did indeed solve the problem 😃