Authorization failed when sending transactional emails

Developer help Self-hosting
1

Hi!

My website is hosted on Pikapods and I’m using Brevo for transactional emails.

I was testing my settings and, as I tried to reset a user password, I noticed that even though it says “An email with password reset instructions has been sent” nothing was sent.

Checking the logs, here’s what it show.

Authorization failed
"Unable to determine the authenticated user or integration. Check that cookies are being passed through if using session authentication."

Error ID:
8031ff70-682e-11f0-92fb-d10f23fd306b

----------------------------------------

NoPermissionError: Authorization failed

at authorizeAdminApi (/var/lib/ghost/versions/5.130.1/core/server/services/auth/authorize.js:33:25)

at Layer.handle [as handle_request] (/var/lib/ghost/versions/5.130.1/node_modules/express/lib/router/layer.js:95:5)

at next (/var/lib/ghost/versions/5.130.1/node_modules/express/lib/router/route.js:149:13)

at authenticate (/var/lib/ghost/versions/5.130.1/core/server/services/auth/session/middleware.js:55:13)


[2025-07-24 01:35:37] INFO "GET /ghost/api/admin/site/" 200 13ms
[2025-07-24 01:35:38] INFO "GET /ghost/api/admin/authentication/setup/" 200 35ms
[2025-07-24 01:35:42] INFO "POST /ghost/api/admin/authentication/password_reset/" 200 591ms

As I said, I’m using Brevo. When I changed it to Gmail and it worked… but I won’t use Gmail, since I need it to me have my domain as “from”.

The other emails, like the Complete your sign up ones, are working fine (apparently).

Does anybody knows what’s happening and how to fix this issue?

Thanks in advance!

2

That error is unrelated to the transactional emails. That just shows that somebody that doesn’t have a valid session cookie for the Ghost admin (you) tried to access the Ghost admin and was rejected. The result: the login page is rendered.

If you see An email with password reset instructions has been sent, Ghost has sent the email to Brevo and not received an error from them.

The issue, as far as I can see it, is with Brevo in this case. It’s been a while since I used them, but there should be logs on their end as well, which you could check.

1 Like
3

Well, just went to Brevo to check it’s logs and I didn’t even have to look into it. I noticed that the emails that were delivered were all @mydomain, while the ones that were not were all @smtp.brevo.

I changed this on Pikapods and it worked. :slight_smile:

So here’s the tip: on the from part of you settings, when using Brevo, always use your domain! :slight_smile:

3 Likes