A 401 invalid_key means the API key is missing, wrong, revoked, or sent incorrectly. Check that you're sending 'Authorization: Bearer YOUR_KEY' with a current, workspace-correct key. It's an auth problem, never a data problem.
Check the header
The header must be exactly Authorization: Bearer YOUR_KEY. Common mistakes: missing "Bearer ", a trailing newline or space, the wrong environment's key, or the key wrapped in quotes it shouldn't have. Copy it fresh from Settings → API.
Key validity
The key may have been revoked or rotated (see Authentication and API keys). Keys are shown once at creation — if you lost it, create a new one rather than guessing. The key list shows last-used timestamps to confirm whether a key is live.
Right key for the right workspace
Keys are workspace-bound. A key from one workspace returns 401 against another. Cross-workspace automation needs a key per workspace by design (see Multi-workspace user management).
403 vs 401
If you get 403 insufficient_scope instead, the key is valid but lacks the scope for that call — the message names the missing scope. Re-create the key with the needed scope (see API error codes reference). Log the request_id from any error for support.
