I’m building a native iOS app that authenticates with Roboflow OAuth (PKCE public client, rfoa_ access tokens). Reads, model downloads, and /{workspace}/{project}/upload/zip all accept the token, but the single-image upload endpoint crashes:
curl -X POST -H 'Authorization: Bearer rfoa_x' https://api.roboflow.com/dataset/p/upload
returns HTTP 500 {"error":"Unknown error"} for any rfoa_ token (valid or fake), whatever the body: base64, multipart, or image= URL. The same token passed as ?api_key= does the same thing. A non-OAuth fake key gets the normal 401, and other routes like /annotate and /upload/zip correctly return 401 “This OAuth token is invalid or expired” for a bad OAuth token. The docs and OpenAPI spec say OAuth tokens work on this route. Is this a known issue, or is OAuth not meant to cover single-image upload?
fwiw, I prefer the zip upload and have switched to it, but I originally coded using an API key and the single-image upload. so, this is simply an FYI.
thanks!