name: chatwoot-nginx-underscore-header-fix

description: Fix Chatwoot 401 errors caused by nginx dropping underscores_in_headers

Chatwoot + Nginx: 401 Unauthorized despite valid token

Problem

Chatwoot self-hosted behind nginx returns 401 on API calls even with a valid api_access_token. The token exists in the database and belongs to a valid user.

Root Cause

Nginx's default underscores_in_headers off silently drops headers containing underscores. The Chatwoot API uses api_access_token header — which never reaches the upstream Chatwoot Rails app.

Solution

Add to /etc/nginx/nginx.conf inside the http { } block:

`

underscores_in_headers on;

`

Then reload: nginx -s reload

Verification

`bash

From outside

curl -s "https://chat.rochasalesseguros.com.br/api/v1/accounts/1/inboxes.json" \

-H "api_access_token: TOKEN_HERE"

Inside container (if Docker)

docker exec root-rails-1 curl -s "http://localhost:3000/api/v1/accounts/1/inboxes.json" \

-H "api_access_token: TOKEN_HERE"

`

Environment

• - VPS: 31.97.243.106 (root/Marcia19671951@)
• - Chatwoot: Docker container root-rails-1 on custom network root_chatwoot
• - URL: https://chat.rochasalesseguros.com.br
• - Account ID: 1
• - SuperAdmin: Anderson (token stored in public.access_tokens table)
• - Chatwoot runs on Puma port 3000 inside container, nginx reverse-proxies from 443

Pitfalls

• - Tokens with underscores in header names are silently dropped by default nginx
• - FORCE_SSL=true in Chatwoot ENV works fine when nginx passes X-Forwarded-Proto: https
• - Docker network allows direct container-to-container on internal IPs (e.g., 172.18.0.2)