HTTP request failed with status 401 when testing httr integration without production credentials

Answer to the core questions

1. What happens to the authentication header when a handle is reused after being closed?

When a handle() object is closed with close_handle(), httr discards any authentication credentials that were attached via authenticate(). The closed handle no longer contains an Authorization header, so any subsequent request using that handle will be sent without authentication and will typically receive a 401 Unauthorized response. A new handle must be created and authenticate() called again before the request can succeed.

2. Do special characters in passwords require manual URL‑encoding when using authenticate()?

No. authenticate() builds the Authorization header by base‑64‑encoding the string "user:password". The password is transmitted inside the base‑64 payload, so characters such as @, :, or ! are safe and do not need URL‑encoding. Manual encoding is only required if the password is placed in a URL component (e.g., a query string) rather than in the header.

Confirmed facts (based on current httr implementation)

• Closing a handle removes its authentication state.
• The Authorization header is regenerated each time authenticate() is called.
• Special characters in the password are handled correctly by base‑64 encoding; no extra encoding is performed.
• The same behavior applies to other authentication schemes supported by httr (e.g., Digest).

Practical steps for your test scenario

1. h <- handle("https://api.example.com")
2. h <- authenticate(h, "user", "p@ss:word!")
3. close_handle(h)
4. h2 <- handle("https://api.example.com")
5. Attempt a request without re‑authenticating:

   GET(h2, path = "/resource")  # Expect 401
   

6. Re‑authenticate on the new handle:

   h2 <- authenticate(h2, "user", "p@ss:word!")
   GET(h2, path = "/resource")  # Expect 200
   

7. Use verbose() to inspect the headers if needed:

   GET(h2, path = "/resource", verbose())
   

What to verify next

Run the above steps in your environment. If you still receive a 401 after re‑authenticating, check whether you are using a different authentication scheme (e.g., Digest). The same rule about handle closure applies, but the encoding details may differ.

Missing diagnostic detail

Could you confirm which authentication scheme you are using (Basic, Digest, or others)? This will help refine any additional encoding or retry considerations.