Getting 401 unauthorized when accessing Mailgun API events endpoint

I’m having trouble accessing Mailgun’s events API and keep running into authorization issues. Every time I try to make a request, I get a 401 unauthorized response even though I’m including my credentials.

I’ve attempted this using both Postman and curl commands but both methods return the same error. For the curl approach, I’m using something like:

curl -i -X GET -u [email protected]:my_password 'https://api.mailgun.net/v3/mail.example.com/events'

I’ve double checked my email and password multiple times and they’re definitely correct. I can log into the Mailgun dashboard without any problems using the same credentials.

Has anyone encountered this before? Am I missing something obvious in how I’m formatting the authentication? Any help would be really appreciated.

Yeah, this trips up tons of people starting with Mailgun. Your dashboard login won’t work for API calls - they’re completely separate systems. You need basic auth with ‘api’ as the username and your private key as the password. Also, double-check you’re using the right private key if you’ve got multiple domains set up. I’ve seen people grab keys from the wrong domain all the time. Switch to proper API key auth and those 401 errors will vanish.

You’re using the wrong authentication method. Mailgun’s API doesn’t accept email/password - it needs API keys instead. Grab your private API key from your Mailgun dashboard (Settings > API Keys). Here’s the curl command for the events endpoint:

curl -i -X GET --user 'api:your-private-api-key' 'https://api.mailgun.net/v3/mail.example.com/events'

Don’t forget the ‘api:’ prefix before your private key. I ran into this same thing when I started - dashboard login credentials are totally different from API access.

Yeah, that’s definitely the issue - Mailgun’s API auth is confusing at frst. Make sure you’re using the private key, not the public one. Double-check that your domain name in the URL exactly matches what you’ve got set up in Mailgun. The subdomain part trips ppl up sometimes.