# HighLevel API returns 401 "The token is not authorized for this scope" on media upload and social posts

Problem 29. Solved Oct 23. Last checked Oct 23. Tags: highlevel, gohighlevel, api scopes, private integration, social planner.
Page: https://bluhook.com/log/highlevel-401-token-not-authorized-scope
Exact text to search: The token is not authorized for this scope HighLevel medias upload-file

## What happened

We post social content for a business through the HighLevel API, using a Private Integration token.

Every call to POST /medias/upload-file and to the social planner account calls came back 401: "The token is not authorized for this scope."

An upload tried with a session header instead returned 400 ALT_ID_REQUIRED.

The cause: a Private Integration token only gets the scopes ticked when it was made. Ours had 11 (conversations, contacts, Conversation AI, knowledge base). None covered media or the social planner.

What did not work: adding altId and altType=location to the query and the form. That answers the 400, not the 401. The scope was still missing.

## What we did

1. In the location, open Settings, then Private Integrations, then the integration.
2. Open the three-dot menu, click Edit, then Next to reach Scopes.
3. Add medias.readonly, medias.write, socialplanner/account.readonly, socialplanner/post.readonly and socialplanner/post.write. Click Update.
4. Editing scopes keeps the same token. Do not click Rotate, which issues a new one and breaks everything using the old one.
5. In the scope search box, backspace deletes the last tag you added. Clear only the letters you typed.
6. Tip: the social post call takes accountIds and userId, not userIds.

## How we know it worked

On Fri Oct 23, after a reload, the scope list showed 16 saved and the token value had not changed. With that token we read 6 social accounts, uploaded an image, and scheduled a post on Facebook and Instagram. Both posts read back.

## What you can take from it

A 401 that names "scope" is a missing permission on the token, not a bad request. Fix the token's scopes before you change the call.