# unauthorized

The API key is missing, invalid or revoked.

## What it means

The request had no `Authorization` header, or the key in it does not exist, has been revoked, or belongs to a deleted app. Keys are checked on every request; a revoked key stops working within 5 seconds everywhere.

## Why it happens

- The header is missing or not in the form `Authorization: Bearer sk_live_…` (or `sk_test_…`).
- The key was revoked in Settings, or the app it belongs to was deleted.
- The key was copied with a missing character or a trailing newline from a secrets file.
- A publishable or dashboard token was used instead of an API key.

## What to do

1. Create a key in Settings → API keys and send it as `Authorization: Bearer <key>`.
2. Read keys from an environment variable or secret store, trimmed, never from client-side code.
3. Repeated failures from one address are rate-limited (`429 rate_limited`), so fix the key before retrying.

- [Open the dashboard](/app/domains)
- [All limits](/docs/limits-and-pricing)

## In the API

```
HTTP 401

{
  "error": {
    "code": "unauthorized",
    "message": "The API key is missing, invalid or revoked.",
    "fix": "Send a valid key as \"Authorization: Bearer sk_live_…\" or \"sk_test_…\".",
    "docs": "https://apexly.dev/docs/errors/unauthorized"
  }
}
```