401 invalid API key: the first five checks

Why a valid-looking key is rejected, and how to isolate client configuration from a disabled key.

Reviewed 2026-11-12 · Chinese detail: 完整中文页

What 401 means

The server did not accept the credential. It does not mean the model is down or the request body is wrong. In most cases the key is fine but the client is sending something slightly different from what you think.

Check in this order

1. Whitespace and newlines. Copy the key again and inspect both ends; a trailing newline is common when reading from a file.

2. Environment variable name. Your client may expect a different variable than the one you exported.

3. Wrong environment. Test and production keys are often different, and so are keys for different relays.

4. Disabled or expired key. Check the dashboard status and expiry date.

5. Wrong base URL. A key for one provider will not work against another provider's endpoint.

The curl test

Send a minimal request with curl, using the same base URL and key. If curl succeeds, the key is valid and the problem is in the client configuration. If curl also fails, the key or endpoint is the problem.

Do not debug by sharing the key

Never paste a full key into a chat, issue, or support form. Share the last six characters, the exact error message, and the base URL instead.

This page is general guidance, not a statement about any specific provider. For measured data, see the relay directory and method.