REST API POST: User is not authorized despite being admin I'm working on a quick script as a proof of concept to POST content to my Drupal instance using the REST API.

The user I'm trying to post as is an Administrator, but I get an error that they don't have permission to create the Content.

Here's the simple script I'm using so far (removed a lot of debug and extra code for brevity). It gets a CSRF token, constructs the JSON body and POST's the request to the REST endpoint to create a piece of content of the game type.

&lt;?php

$autoloader = require_once __DIR__ . '/../../vendor/autoload.php';
use GuzzleHttp\Client;

$client = new Client([ 'base_uri' =&gt; $url ]);

$csrfResponse = $client-&gt;request('GET', '/rest/session/token');
$csrfToken = trim($csrfResponse-&gt;getBody());

$jsonPayload = [
    'type' =&gt; 'game',
    'title' =&gt; [[ 'value' =&gt; 'Test Game ' . strtotime('now') ]],
];

$postResponse = $client-&gt;request('POST', '/entity/node?_format=json', [
    'auth' =&gt; [$user, $password],
    'body' =&gt; json_encode($jsonPayload),
    'headers' =&gt; [
        'Content-Type' =&gt; 'application/json',
        'X-CSRF-Token' =&gt; $csrfToken
    ]
]);

debug("Status Code: " . $postResponse-&gt;getStatusCode());
debug($postResponse-&gt;getBody());


Problem: I get 403 Forbidden response telling me:

{"message":"You are not authorized to create this node entity of bundle game."}


This despite the fact that the user is an Admin (and I even tried giving them explicit permission to Create and Review contents of the Game type). I get the same error if I put in a bogus username and password as well.

The answers suggested in the related question about "403 Forbidden when creating a page with RESTful API" did not work for me.
My problem was that the Basic Auth module was not enabled. I only found that out by chance as I was scrolling through the enabled modules, as the error message above didn't indicate how authentication was being done.