I get a 401 when trying to connect to the Airbyte api

[AHulshoff]

I have installed Airbyte OSS on my kubernetes cluster with the official helm chart version 1.6.5 by using the following values.yaml:

global:
  deploymentMode: "oss"
  edition: "community"
  auth:
    enabled: true
    instanceAdmin:
      secretName: airbyte-config
      firstName: System
      lastName: Administrator
      emailSecretKey: airbyte_admin_email
      passwordSecretKey: airbyte_admin_pwd
    cookieSecureSetting: "false"
  database:
    type: internal
    host: shared-pgsql
    port: 5432
    database: airbyte
    user: postgres
    password: postgres
storage:
  type: minio
webapp:
  service:
    type: LoadBalancer
    port: 80
    annotations:
      external-dns.alpha.kubernetes.io/hostname: "<redacted>"
  ingress:
    enabled: true
    annotations:
      kubernetes.io/ingress.class: nginx
    hosts:
      - host: "<redacted>"
        paths:
          - path: /
            pathType: Prefix
    tls:
      - secretName: wildcard-certificate
        hosts:
          - "<redacted>"
postgresql:
  enabled: false
externalDatabase:
  host: shared-pgsql
  port: 5432
  database: airbyte
  user: postgres
  password: postgres
minio:
  image:
    tag: RELEASE.2025-02-28T09-55-16Z-cpuv1 # {"$imagepolicy": "shared:minio:tag"}
temporal:
  extraEnv:
    - name: SQL_TLS_ENABLED
      value: "false"
    - name: POSTGRES_TLS_ENABLED
      value: "false"

After the installation, I can log in and build connections. Then I wanted to integrate this with OpenMetadata. For that I need the API. This didn't work. So I tried it with curl on the command line with the following commands:

AIRBYTE_TOKEN=$(curl -s --request POST --url http://<redacted>/api/v1/applications/token \
--header 'Accept: application/json' \
--header 'Content-Type: application/json' \
--data '{ "grant-type": "client_credentials", "client_id": "<redacted>", "client_secret": "<redacted>" }' | jq '.access_token')

echo
echo $AIRBYTE_TOKEN
echo
echo $AIRBYTE_TOKEN | jq -R 'gsub("-";"+") | gsub("_";"/") | split(".") | .[1] | @base64d | fromjson'
echo

curl -s --request GET \
--url http://<redacted>/api/v1/workspaces \
--header 'accept: application/json' \
--header "authorization: Bearer $AIRBYTE_TOKEN" | jq --color-output

With the client_ and secret_id retrieved from the webapplication at Settings->Applications, where the Default User Application is available. I am not sure if the default has enough rights, but I cannot see how to make a new entry. Anyway, the above commands gave me the following results (in the order of execution):

"eyJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJhaXJieXRlLXNlcnZlciIsInN1YiI6IjAwMDAwMDAwLTAwMDAtMDAwMC0wMDAwLTAwMDAwMDAwMDAwMCIsImV4cCI6MTc0MTg5NjU2Mywicm9sZXMiOlsiQVVUSEVOVElDQVRFRF9VU0VSIiwiUkVBREVSIiwiRURJVE9SIiwiQURNSU4iLCJXT1JLU1BBQ0VfUkVBREVSIiwiV09SS1NQQUNFX1JVTk5FUiIsIldPUktTUEFDRV9FRElUT1IiLCJXT1JLU1BBQ0VfQURNSU4iLCJPUkdBTklaQVRJT05fTUVNQkVSIiwiT1JHQU5JWkFUSU9OX1JFQURFUiIsIk9SR0FOSVpBVElPTl9SVU5ORVIiLCJPUkdBTklaQVRJT05fRURJVE9SIiwiT1JHQU5JWkFUSU9OX0FETUlOIl19.5unaJSzMmrOHoUVoRCW5UJVeUHP7EOSBug5-GzkNI7U"

{
  "iss": "airbyte-server",
  "sub": "00000000-0000-0000-0000-000000000000",
  "exp": 1741896563,
  "roles": [
    "AUTHENTICATED_USER",
    "READER",
    "EDITOR",
    "ADMIN",
    "WORKSPACE_READER",
    "WORKSPACE_RUNNER",
    "WORKSPACE_EDITOR",
    "WORKSPACE_ADMIN",
    "ORGANIZATION_MEMBER",
    "ORGANIZATION_READER",
    "ORGANIZATION_RUNNER",
    "ORGANIZATION_EDITOR",
    "ORGANIZATION_ADMIN"
  ]
}

{
  "message": "Unauthorized",
  "_links": {
    "self": {
      "href": "/api/v1/workspaces",
      "templated": false
    }
  },
  "_embedded": {
    "errors": [
      {
        "message": "Unauthorized",
        "_links": {},
        "_embedded": {}
      }
    ]
  }
}

As you can see, I do get an access token back. But as soon as provide that to api that I want to use, I get a 401 (unauthorized) back. When I decode the token, it looks a bit strange to me. However this can be by design.

Is there something I have missed. So far I couldn't find anything about this. Nor am I sure if it is a permission issue or a installation/configuration issue. I am not too experienced with Airbyte either. Just trying to figure out how it works. Pretty much everything else I got to work, but this one puzzles me.