API key errors (401)
A 401 response means the API could not accept the credential you sent: it was missing, mistyped, revoked, expired, or a sign-in token that has run out. The error.code field in the response tells you which. In most cases the fix is to send the right key, or to create a new one.
What each code means
| Code | Message | What to do |
|---|---|---|
unauthenticated | ”Authentication is required. Send an API key or access token as a Bearer token.” | Send the header Authorization: Bearer followed by your key on every request. |
invalid_api_key | ”The API key is invalid.” | Copy the whole key again. Secret keys start with sk_live_. Check for a space or line break at the end. |
revoked_api_key | ”This API key was revoked. Create a new one in Settings → API keys.” | Someone revoked the key. Create a new key and update it wherever it is stored. |
expired_api_key | ”This API key has passed its expiry date. Create a new one in Settings → API keys.” | The key had an expiry date that has passed. Create a new key. |
invalid_token | ”The access token is invalid or expired. Run syntic login again.” | A Syntic Code sign-in token could not be verified. Sign in again. |
token_revoked | ”This sign-in was revoked. Run syntic login again.” | The sign-in was ended elsewhere. Sign in again. |
Checklist
- Is the header there? If you set it and still get
unauthenticated, a proxy or redirect may be dropping it. Call the API address from the docs directly. - Is it the right kind of key? A publishable
pk_live_key cannot call the API; see API access denied (403). - Is the variable set where the code runs? Environment variables set in one terminal are not visible to a server or a scheduled job started elsewhere.
- Was the key rotated? If a teammate revoked and replaced it, update your secrets store.
Create a new key
See Create an API key. When you replace a key, revoke the old one once nothing uses it any more: Revoke an API key.
If a key may have been exposed, for example pasted in a public place or committed to a repository, revoke it right away and create a new one. Never send a full key to support.
For Syntic Code users
If Syntic Code says “Your session has expired. Run syntic login to reconnect billing.” or “Not signed in”, run syntic login. If the SYNTIC_API_KEY variable is set in your shell, Syntic Code uses that key instead of your sign-in; remove it if it is old.