Posthog API returns a 401 on the client side

[yzdbg]

Bug description

Fetching feature flags from our frontend application with the code below :

    getFeatureFlags(
      posthogApiUrl,
      posthogProjectId,
      posthogPrivateApiKey
    ): Promise<any> {
      return axios.get(
        `${posthogApiUrl}/projects/${posthogProjectId}/feature_flags`,
        {
          headers: {
            Authorization: `Bearer ${posthogPrivateApiKey}`,
          },
        }
      )
    },

returns a 401 as follows :

{
"type":"authentication_error",
"code":"authentication_failed",
"detail":"No temporary_token set. That means you're either trying to access this API from a different site, or it means your proxy isn't sending the correct headers. See https://posthog.com/docs/deployment/running-behind-proxy for more information.",
"attr":null}

while using a curl of the same request works as expected with no error.

How to reproduce

1. Call the Posthog API from a frontend application with the endpoint https://app.posthog.com/api/projects/{project-id}/feature_flags
2. Confirm 401 error

Environment

• [x] PostHog Cloud US, project ID: [please provide from https://app.posthog.com/settings/project-details#variables]
• [ ] PostHog Cloud EU, project ID: [please provide from https://eu.posthog.com/settings/project-details#variables]
• [ ] PostHog Hobby self-hosted with docker compose, version/commit: [please provide]
• [ ] PostHog self-hosted with Kubernetes (deprecated, see "Sunsetting Kubernetes support"), version/commit: [please provide]

Additional context

The same request used to work perfectly for over a year and only stopped working a few days ago.

[neilkakkar]

Hi @yzdbg out of curiosity why are you calling this endpoint? Generally you don't want to depend on this for flag evaluation, use the local evaluation endpoint instead, which gives you minimal things you need quickly -> https://posthog.com/docs/api/feature-flags#get-api-projects-project_id-feature_flags-local_evaluation

[neilkakkar]

(also cc: @benjackwhite )

[yzdbg]

@benjackwhite Total shot in the dark, but this might be the breaking commit : https://github.com/PostHog/posthog/pull/20172

As our endpoints stopped working at the same time coincidentally :