unauthorized

What it means

The request had no Authorization header, or the key in it does not exist, has been revoked, or belongs to a deleted app. Keys are checked on every request; a revoked key stops working within 5 seconds everywhere.

Why it happens

• The header is missing or not in the form Authorization: Bearer sk_live_… (or sk_test_…).
• The key was revoked in Settings, or the app it belongs to was deleted.
• The key was copied with a missing character or a trailing newline from a secrets file.
• A publishable or dashboard token was used instead of an API key.

What to do

1. Create a key in Settings → API keys and send it as Authorization: Bearer <key>.
2. Read keys from an environment variable or secret store, trimmed, never from client-side code.
3. Repeated failures from one address are rate-limited (429 rate_limited), so fix the key before retrying.