Drıftstack docs
Docs

API key not recognised, revoked, or expired (401)

You might be here because: “The supplied API key is not recognised” · “This API key has been revoked” · “This API key has expired” · “API key missing or invalid” · “401 from the API” · “my script stopped working overnight” · “Your sign-in or API key was not accepted. Check Settings and try again.” · “the key worked yesterday” · “I rotated my key and now nothing works” · “SDK says InvalidKeyError”

Short answer

A 401 means the key itself was refused: not recognised (a typo or partial copy, a key from another account or server, or a key whose account was deleted), revoked (someone pressed Revoke), or expired (its expiry date passed, or it was rotated and the old key’s grace period, up to 24 hours, ended). Open the dashboard’s API keys page, find the key by its prefix, and create or rotate a key, then update your code. If you rotated your key and now nothing works, your code still sends the old key.

Check first

  • Which type did you get? invalid-key, revoked-key and expired-key are all 401 and none is retryable.
  • Whole key pasted? The keys page shows each key’s prefix, so you can match the row to what your code sends.
  • Cloud key on a self-hosted server, or the other way round? That never works (see Related).
  • Desktop app saying “Your sign-in or API key was not accepted. Check Settings and try again.”? That is the app’s own credential — see Related.

Likely causes and fixes

  1. “The supplied API key is not recognised.” No key has that prefix, or the secret does not match the key that does; a key whose account was deleted gets the same answer. Fix: copy the key again from where you saved it; if you no longer have it, create a new one — the full key is never shown again.

  2. “This API key has been revoked.” Someone with access pressed Revoke, which takes effect immediately. Fix: create a new key. If it wasn’t you, treat it as a security event: check the audit log, rotate your other keys, and tell a person. A webhook event fires when a key is revoked, if you want alerting.

  3. “This API key has expired.” The key’s expiry has passed; it is checked on every request. After a rotation the old key stops at the time shown under “Old key valid until”: up to 24 hours later, less if it was already set to expire sooner. Update every place that still uses it.

  4. 403 “Account is suspended.” instead of 401. The key is fine; the account is not — see Related.

  5. “API key missing or invalid.” No bearer token was sent, or it was malformed. Check the header your code sends.

If it still fails

If a key you just created or rotated in the dashboard is refused, press Talk to a person in this chat (or open Help) and include: account email, the key’s name and prefix (never the full key), the response type and detail, the time, and whether the key was made in the dashboard. A revocation you did not make is handled by a person.