Browsing the website and calling the API are separate access paths. You can browse the public STIG Catalog without signing in, but the STIG listing API requires authentication.
Supply your API token in the Authorization header:
Authorization: Bearer YOUR_TOKEN
The authentication guide at https://docs.stigviewer.com/authentication explains obtaining a token through SAMS. A browser sign-in alone does not add that header to a script or integration.
If a request returns 401 UNAUTHORIZED with “Missing or invalid Authorization header,” check that the header is present and uses the format above. Do not include quote characters around the token value in the header itself.
A valid token can still be restricted by its scope or product access. Include the exact error message when asking for help instead of assuming every access problem means the token has expired.
Keep your token private. Share the endpoint, status code, and error message with credentials removed.