401 Unauthorized error from an AI API: causes and fixes

What 401 means, and what it does not

A 401 is an answer from the provider, which is good news: the URL works and the service is up. It means "I don't know who you are". Its sibling, 403, means "I know who you are, but you can't do that". Neither has anything to do with your model settings, context size or the queue.

Apps show it in different ways: a red "Unauthorized" toast, "invalid API key", "authentication failed", or the raw number. Whatever the wording, the problem is the credential that went along with the message.

Causes, most common first

• A partial copy: the last few characters were missed, or you copied the masked version. Many providers show a full key once and afterwards only something like sk-...abcd.
• Invisible extras: a space or line break at either end, quotation marks, or "Bearer " typed in front. Apps add that word themselves.
• A revoked key, or one whose account changed.
• A key from one provider sent to another provider's URL, common after switching connection profiles.
• The key is saved in a different slot. SillyTavern keeps a separate key for each Chat Completion Source, and JanitorAI keeps one per proxy configuration, so a key saved elsewhere is not the one being sent.

The fix, step by step

• On the provider's site, make a new key instead of hunting for the old one, and name it after the app.
• Copy it with the provider's copy button rather than by dragging over the text.
• In the app, clear the key field completely, then paste. Do not add Bearer or quotes.
• Check that the URL in the same profile belongs to the same provider as the key.
• Save. In JanitorAI, reload the tab as well. Then send one short message.
• Once it works, revoke the old key so fewer valid keys exist.

Telling the causes apart

• The key fails in the provider's own tester too: the key itself is cut short or revoked.
• It passes the provider's tester but fails in the app: something in the app, such as a stray space, the wrong slot or the wrong profile.
• It worked until today: the key was revoked or rotated, or an app update cleared the field.
• You see 403 instead: the key was accepted but the action was not, for example a model outside your plan. That one is covered under model not found.

The 401 on UnsavedAI

Our gateway answers a missing or wrong key with "A valid API key is required." or "A valid account API key is required." A key used for something it is not allowed to do gets "This API key cannot perform that action." A model your plan does not include gets "This model is not included in your plan.", which is not a key problem at all.

Our keys start with sk-, are 67 characters and contain no spaces. The full value is shown once when you make it, then masked under Your keys. A revoked key stops working in every app at once. Paste a key into the key tester on the Setup page and it tells you whether the key is cut short, revoked or fine, which settles in seconds whether the key or the app is at fault. Extra keys cost nothing, because limits belong to the account; see one account, many apps.

Questions people ask