Skip to content

invalid_api_key

Step 3 of the bearer check (AGENTS.md §5): the token isn’t a Deedglass API key, its prefix is unknown, its mode doesn’t match, or the secret is wrong.

HTTP 401 · authentication_error · not retryable

Step 3 of the bearer check (AGENTS.md §5): the token isn’t a Deedglass API key, its prefix is unknown, its mode doesn’t match, or the secret is wrong. Every one of those gets the same message, so the answer doesn’t tell a guesser which part was wrong. A key whose org isn’t active gets it too. An Authorization header with a scheme other than Bearer gets this code with the message “The Authorization header must be Bearer followed by an API key (dg_live_… or dg_test_…).” Each failure counts toward the failed-auth limiter (rate_limited).

The response carries WWW-Authenticate: Bearer realm="deedglass", error="invalid_token", error_description="<the message>".

Copy the key again from where you stored it: all 49 characters, starting with dg_live_ or dg_test_. Send it as Authorization: Bearer dg_live_…. If you no longer have it, create a new key in Console › Agents. Deedglass shows a key’s secret once, at creation.

HTTP 401 · invalid_api_key
{
"error": {
"type": "authentication_error",
"code": "invalid_api_key",
"message": "The API key isn't valid. Check that you copied all of it (it starts with dg_live_ or dg_test_), or create a new one in Console › Agents.",
"param": null,
"request_id": "req_01j9zr3m5k8q2w7x4t6v0b1c9d",
"doc_url": "https://docs.deedglass.com/errors/invalid_api_key"
}
}

The message is for a person and can get more exact over time: branch on type and code, never on the message.

SDK Raised as
TypeScript (@deedglass/sdk) AuthenticationError with code === "invalid_api_key"
Python (deedglass) deedglass.AuthenticationError with .code == "invalid_api_key"