Skip to content
deedglassdocs

api_key_expired

Step 5: the key passed the hash check, and it was rolled, and its overlap window has ended.

HTTP 401 · authentication_error · not retryable

What happened

Section titled “What happened”

Step 5: the key passed the hash check, and it was rolled, and its overlap window has ended. Only rolled keys expire. The message names the time in UTC. Like a revoked key, it doesn’t count toward the failed-auth limiter, and the response carries the WWW-Authenticate challenge with error="invalid_token".

What to do

Section titled “What to do”

Use the key that replaced it (the roll response returned it once). If you don’t have it, create a key in Console › Agents.

Example

Section titled “Example”
HTTP 401 · api_key_expired
{
  "error": {
    "type": "authentication_error",
    "code": "api_key_expired",
    "message": "The API key expired at 2026-10-04 10:03 UTC after it was rolled. Use the new key, or create one in Console › Agents.",
    "param": null,
    "request_id": "req_01j9zr3m5k8q2w7x4t6v0b1c9d",
    "doc_url": "https://docs.deedglass.com/errors/api_key_expired"
  }
}

The message is for a person and can get more exact over time: branch on type and code, never on the message.

In the SDKs

Section titled “In the SDKs”
SDK Raised as
TypeScript (@deedglass/sdk) AuthenticationError with code === "api_key_expired"
Python (deedglass) deedglass.AuthenticationError with .code == "api_key_expired"
Section titled “Related”