invalid_api_key
Step 3 of the bearer check (AGENTS.md §5): the token isn’t a Deedglass API key, its prefix is unknown, its mode doesn’t match, or the secret is wrong.
HTTP 401 · authentication_error · not retryable
What happened
Section titled “What happened”Step 3 of the bearer check (AGENTS.md §5): the token isn’t a
Deedglass API key, its prefix is unknown, its mode doesn’t match, or the secret is wrong. Every
one of those gets the same message, so the answer doesn’t tell a guesser which part was wrong. A
key whose org isn’t active gets it too. An Authorization header with a scheme other than
Bearer gets this code with the message “The Authorization header must be Bearer followed by an
API key (dg_live_… or dg_test_…).” Each failure counts toward the failed-auth limiter
(rate_limited).
The response carries
WWW-Authenticate: Bearer realm="deedglass", error="invalid_token", error_description="<the message>".
What to do
Section titled “What to do”Copy the key again from where you stored it: all 49 characters, starting with
dg_live_ or dg_test_. Send it as Authorization: Bearer dg_live_…. If you no longer have it,
create a new key in Console › Agents. Deedglass shows a key’s secret once, at creation.
Example
Section titled “Example”{ "error": { "type": "authentication_error", "code": "invalid_api_key", "message": "The API key isn't valid. Check that you copied all of it (it starts with dg_live_ or dg_test_), or create a new one in Console › Agents.", "param": null, "request_id": "req_01j9zr3m5k8q2w7x4t6v0b1c9d", "doc_url": "https://docs.deedglass.com/errors/invalid_api_key" }}The message is for a person and can get more exact over time: branch on type and code, never on the message.
In the SDKs
Section titled “In the SDKs”| SDK | Raised as |
|---|---|
TypeScript (@deedglass/sdk) |
AuthenticationError with code === "invalid_api_key" |
Python (deedglass) |
deedglass.AuthenticationError with .code == "invalid_api_key" |