Fix 401 Unauthorized: API Key is required or Invalid API key

Every public API route needs an API key. A 401 means the key was not found, or it was found and rejected.

{ "error": "Unauthorized", "message": "API Key is required." }

{ "error": "Unauthorized", "message": "Invalid API key." }

Causes

• API Key is required.: no Authorization: Bearer or X-API-Key header reached the server. Proxies, redirects and HTTP clients that drop headers on redirect are common culprits.
• Invalid API key.: the key was mistyped, truncated, revoked, deactivated or has expired. The key is hashed on arrival, so a stray space or newline makes it invalid.
• The key belongs to a different environment or account than you think.

Fix

1. Print the exact header your code sends and check it starts with Bearer sk_.
2. Trim whitespace and newlines from the key when you load it from an environment variable.
3. Open Settings, Account settings, API keys and confirm the key is active. If in doubt, create a new key and replace it.