"401 Unauthorized" / invalid API key from the Claude API: how to fix it

The Claude API documents a 401 as an authentication_error: there is a problem with your API key, for example it is malformed, revoked or expired. The server could not accept who you said you were, so it did not look at the rest of the request.

The error looks like this:

401 Unauthorized: authentication_error invalid x-api-key

How to fix it

1. Check the key itself. Copy it again from the Claude Console with no spaces or quote marks around it. A key that was cut off, or one from another service, gives a 401.
2. Check it was not revoked or expired. Open the key list in the Console. If the key is gone or marked expired, create a new one and replace it everywhere.
3. Check how it is sent. The API reads the key from the x-api-key header. SDKs read the ANTHROPIC_API_KEY environment variable by default, so make sure it is set where the code actually runs (see the missing environment variable page).
4. Tell 401 from 403. A 403 permission_error means the key is valid but not allowed to use that resource. That is a settings question in the Console, not a bad key.
5. Keep it in server code. Never ship the key in browser code. Call the API from a server or backend function.

What you should see

The same request returns a normal response instead of an error object with "type": "authentication_error".

Quick questions

What does a 402 or 429 mean?

The docs list 402 as a billing problem and 429 as a rate limit. They are different from a 401.

Where do I find the request ID?

Every response has a request-id header, also in the error body as request_id. Include it if you contact support.

Sources and date checked

• Claude API errors: https://platform.claude.com/docs/en/api/errors (checked 2026-11-01)

Written in our own words from the official pages above. Tool names are only references; we are not affiliated with them. Commands change between versions, so check the linked docs if something differs.