Whilst creating a Visual Studio Team Services (formally Visual Studio Online) extension to work on some work items, I came across the following issue when using the REST client to get a list of work items:

401 Exception
TFS.WebApi.Exception: 401 : error (Unauthorized) in Chrome
401 Exception - Edge
The same error in Microsoft Edge

As I have been at this for a while, I missed an update to the manifest that defines Scopes, which “control what resources can be accessed by your extension and what operations your extension is allowed to perform on those resources”.

Once adding scopes to the manifest, I needed to remove the extension to from the marketplace admin portal, add it again, and share to the VSTS accounts that they were once shared with. The account admins will need to add the extension again which will ask for the privileges defined by the scopes added to the manifest.

vsts-installextension-confirmprivs
VSTS will ask for permission to the areas defined in scopes.

Note that the extension just can’t be updated, as the VSTS Marketplace doesn’t yet support any changes to scopes.

If you are still having issues with 401 errors following this, the wrong scopes may be defined or you may need to work on implementing your own authorization; but this should only be necessary when you are not using the inbuilt VSS rest clients.