401 — key rejected

The request was rejected before any business logic ran: no action was performed and nothing was charged. The body is the same on every endpoint: {"success": false, "message": "API key is missing. Provide it in the X-API-KEY header.", "data": null}. The public API does not accept anonymous requests anywhere.

The X-API-KEY header was not sent, was sent with a typo in its name, or its value was truncated when copied — or the key is unknown, deactivated, or expired. The Bearer token of the web dashboard does not work here: the public API authenticates only with an API key, and vice versa — an API key does not open dashboard endpoints.

Make sure the header is named exactly X-API-KEY (not Authorization, not Api-Key) and the value is sent in full. If the key is correct, open the developer section and check that the key is active and has not expired. Retrying is pointless: a 401 is deterministic, and a retry with the same key gets the same response.

GET /user is the cheapest way to check a key. A 200 means the key is alive; a 403 also means authentication succeeded (the key simply lacks the profile.read scope) — and only a repeated 401 confirms that the problem is the key itself.

• Guide: API keys, scopes, and headers
• GET /user
• My API keys
• 403 — insufficient permissions