Drıftstack docs
Docs

API key not recognised, revoked, or expired (401)

You might be here because: “The supplied API key is not recognised” · “This API key has been revoked” · “This API key has expired” · “API key missing or invalid” · “401 from the API” · “my script stopped working overnight” · “Your sign-in or API key was not accepted. Check Settings and try again.” · “the key worked yesterday” · “I rotated my key and now nothing works” · “SDK says InvalidKeyError”

Short answer

A 401 means the key itself was refused: not recognised (a typo or partial copy, a key from another account or server, or a key whose account was deleted), revoked (someone pressed Revoke), or expired (its expiry date passed, or it was rotated and the 24-hour grace period ended). Open the dashboard’s API keys page, find the key by its prefix, and create or rotate a key, then update your code.

Check first

  • Which type did you get? invalid-key, revoked-key and expired-key are all 401 and none is retryable.
  • Whole key pasted? The keys page shows each key’s prefix, so you can match the row to what your code sends.
  • Cloud key on a self-hosted server, or the other way round? That never works (see Related).
  • Desktop app saying “Your sign-in or API key was not accepted. Check Settings and try again.”? That is the app’s own credential — see Related.

Likely causes and fixes

  1. “The supplied API key is not recognised.” No key has that prefix, or the secret does not match the key that does; a key whose account was deleted gets the same answer. Fix: copy the key again from where you saved it; if you no longer have it, create a new one — the full key is never shown again.

  2. “This API key has been revoked.” Someone with access pressed Revoke, which takes effect immediately. Fix: create a new key. If it wasn’t you, treat it as a security event: check the audit log, rotate your other keys, and tell a person. A webhook event fires when a key is revoked, if you want alerting.

  3. “This API key has expired.” The key’s expiry has passed; it is checked on every request. After a rotation the old key expires 24 hours later, so update every place that still uses it.

  4. 403 “Account is suspended.” instead of 401. The key is fine; the account is not — see Related.

  5. “API key missing or invalid.” No bearer token was sent, or it was malformed. Check the header your code sends.

If it still fails

If a key you just created or rotated in the dashboard is refused, press Talk to a person in this chat (or open Help) and include: account email, the key’s name and prefix (never the full key), the response type and detail, the time, and whether the key was made in the dashboard. A revocation you did not make is handled by a person.