Skip to main content

api_key_invalid

HTTP 401, type authentication_error.

The API key was not recognised.

Why it happened​

The key does not exist, has been revoked, or has expired after a rotation, or its merchant account is not active. A publishable key sent where a secret key is required answers this code too: a publishable key is for the checkout in a browser and is never a credential for this API. Sandbox and production share one host, and a valid key of either environment is accepted on it: the key itself selects the environment, so an environment is never the reason for this code. All of these return the same code: distinguishing them would tell an attacker which guesses were close, or that a key is real.

How to fix it​

Send a current secret key, never a publishable key: a sk_test_ key for sandbox and a sk_live_ key for production.

Authorization: Bearer sk_test_...

Keys are created in the dashboard under Developers > API keys, and each is shown once, when it is created. If you no longer have it, create a new one there and revoke the old.

Retrying: retry only after fixing the Authorization header, to a valid secret key. This request is refused before its Idempotency-Key is claimed, so send the corrected request with the same Idempotency-Key.