topic Re: invalid_src_credentials on REST API Login to prismacloud.io in Prisma Cloud Discussions

invalid_src_credentials on REST API Login to prismacloud.io

ELifshitz — Wed, 23 Apr 2025 07:06:49 GMT

Hi All,

Trying to create a JWT token using the instructions on:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004MQyCAM&lang=en_US

Basically I'm calling

https://api.prismacloud.io/login with a previously created API Key using code that has worked before. (But using other credentials.)

The code fails and I'm getting the error response:

{ message: 'invalid_src_credentials' }

Has anyone seen this error message? I have previously seen a similar error when using invalid credential:

{"message":"invalid_credentials"}

But this error seems to indicate a different(?) problem, and I can't find anything regarding it...

Thanks for any help.

Re: invalid_src_credentials on REST API Login to prismacloud.io

JCalloway1 — Wed, 23 Apr 2025 12:55:27 GMT

Hello!
Are you using the SaaS version of Prisma Cloud? Check your app stack . . . you shoudl be using api2, or api3, or api4 as apposed to just api.
So, you are using "a previously created API Key using code that has worked before. . . but using other credentials". Double check the key and ensure that it has not expired, and that it's role and permission group allow it to do what you need it to do.

Hope this helps!

Re: invalid_src_credentials on REST API Login to prismacloud.io

ELifshitz — Wed, 23 Apr 2025 13:05:18 GMT

Thanks for your comments.

I think the URL I'm using is correct (api2, to be precise, based on the URL of the Prisma UI).

I will double-check permissions etc., but my gut feeling is that the "src" bit is the key here, and it seems to indicate that it's not a simple permissions error...

Again - Thanks!

Re: invalid_src_credentials on REST API Login to prismacloud.io

LMegrelis — Wed, 23 Apr 2025 14:47:00 GMT

Hello!

This may be a trusted IP login issue.

Please see below documentation for reference.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HExNCAW

Refer to Prisma Cloud documentation for a list of NAT Gateway IP Addresses for Prisma Cloud; adding the Ingress address of appropriate tenant to the Trusted Login IP Addresses list allows the API call to /api/v1/authenticate to be processed as expected.

Please keep us posted.

Re: invalid_src_credentials on REST API Login to prismacloud.io

ELifshitz — Thu, 24 Apr 2025 05:38:31 GMT

Thanks!
Marking this as a solution based on the documentation. Will try this and update ASAP.