Issuing a Challenge through the API

I wanted to enable my bot to issue challenges. But before I started coding that, I first tried to simply challenge my bot from the command line, by expanding upon this terse API documentation:

https://lichess.org/api/challenge/{username}

I failed, usually with "Missing authorization header". Clearly, I have no idea how to provide an authorization header. My next step is to write a program that exhaustively lists every permutation of command line arguments. ;-) Please stop me!

The broken requests below all use httpie (https://httpie.org/), but wget or curl would be fine, too.

http -f POST lichess.org/api/{user-challengee}
http -f POST https://lichess.org/api/{user-challengee}
http -f --auth {user-challenger}:{password} POST https://lichess.org/api/challenge/{user-challengee}
http -f --auth {user-challenger}:{password64} POST https://lichess.org/api/challenge/{user-challengee}
http -f --auth {user-challenger64}:{password64} POST https://lichess.org/api/challenge/{user-challengee}
http -f POST https://lichess.org/api/challenge/{user-challengee} --auth {user-challenger}:{password}
http -f POST https://lichess.org/api/challenge/{user-challengee} --auth {user-challenger}:{password64}
http -f POST https://lichess.org/api/challenge/{user-challengee} --auth {user-challenger64}:{password64}
http -f POST lichess.org/api/{user-challengee}
http -f POST https://lichess.org/api/{user-challengee}
http -f POST https://lichess.org/api/challenge/{user-challengee}
http -f --auth {user-challenger}:{password} POST https://lichess.org/api/challenge/{user-challengee}
http -f --auth {user-challenger}:{password64} POST https://lichess.org/api/challenge/{user-challengee}
http -f --auth {user-challenger64}:{password64} POST https://lichess.org/api/challenge/{user-challengee}
http -f POST https://lichess.org/api/challenge/{user-challengee} --auth {user-challenger}:{password}
http -f POST https://lichess.org/api/challenge/{user-challengee} --auth {user-challenger64}:{password64}
http POST https://lichess.org/api/challenge/{user-challengee} --auth {user-challenger64}:{password64}
http --auth-type basic -f POST https://lichess.org/api/challenge/{user-challengee} --auth {user-challenger64}:{password64}
http --auth-type basic --auth {user-challenger64}:{password64} -f POST https://lichess.org/api/challenge/{user-challengee}
http --a {user-challenger}:{password64} POST https://lichess.org/api/challenge/{user-challengee}
http -a {user-challenger}:{password} POST https://lichess.org/api/challenge/{user-challengee}
http -auth {user-challenger}:{password} POST https://lichess.org/api/challenge/{user-challengee}
http -auth {user-challenger}:{password} https://lichess.org/api/challenge/{user-challengee}
http -auth {user-challenger} https://lichess.org/api/challenge/{user-challengee}
http https://lichess.org/api/challenge/{user-challengee} --auth {user-challenger}
http POST https://lichess.org/api/challenge/{user-challengee} rated=false --auth {user-challenger}
http POST https://lichess.org/api/challenge/{user-challengee} --auth {user-challenger}
echo '{"rated": false}' | http POST https://lichess.org/api/challenge/{user-challengee} --auth {user-challenger}
echo '{"rated": false}' | http POST https://lichess.org/api/challenge/{user-challengee} --auth {user-challenger}:{api-token}

Thank you in advance!

Thanks for the tip Berserk! I tried that header.

http POST https://lichess.org/api/challenge/bot9504 Authorization:Bearer\ {api-token} --auth {user-challenger}

Dang! The lichess response still declared "Missing authorization header" :-(

Then I asked httpbin to send back my headers, and the Authorization header was there. Maybe the error is something else, and the lichess message is misleading.

http GET https://httpbin.org/headers Authorization:Bearer\ {api-token}
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Length: 259
Content-Type: application/json
Date: Tue, 19 May 2020 22:26:34 GMT
Server: gunicorn/19.9.0
{
"headers": {
"Accept": "/",
"Accept-Encoding": "gzip, deflate",
"Authorization": "Bearer {api-token}",
"Host": "httpbin.org",
"User-Agent": "HTTPie/0.9.8",
"X-Amzn-Trace-Id": "Root=1-5ec45d1a-110decaccd2fff55e585de29"
}
}

Are you trying to challenge your bot from your regular account?
Not my ultimate goal, but "Yes" for this exercise.
And are you using your account's (not your bot's) token for that?
Yes, I am.

To use your working javascript above, I installed node.js and axios.
And after only a couple days of one thing after another,
I succeeded in challenging bot9504 to a game. Thanks for your help!

In case anyone wants to challenge bot9504 through the API ;-)
here's what finally worked for me.

const axios = require("axios");
const url = "https://lichess.org/api/challenge/bot9504";
const body = {
rated: false,
'clock.limit':600,
'clock.increment':0,
color: "white",
variant: "standard"
};
const options = {
headers: {
"Authorization": "Bearer al7s...w3qn",
"Content-Type": "application/json",
}
};
const awaitPost = async url => {
try {
const response = await axios.post(url,body,options);
const data = response.data;
console.log(data);
} catch (error) {
console.log(error);
}
};
awaitPost(url);