Skip to main content

unauthorized

HTTP 401 · code: "unauthorized" · type: https://docs.formfeed.dev/errors/unauthorized

The request carries no API key, or the key it carries is not one Formfeed accepts. detail says which: no key at all, a key in the wrong format, or API key rejected: followed by the reason (unknown key, key revoked, key expired or organisation deleted). An answer without any key also carries the header WWW-Authenticate: Bearer realm="formfeed".

Example​

{
  "type": "https://docs.formfeed.dev/errors/unauthorized",
  "title": "Unauthorized",
  "status": 401,
  "detail": "API key rejected: key revoked",
  "code": "unauthorized",
  "request_id": "req_4b7c1e9a2f3d4c5b8a6e7f9012"
}

Common causes​

  • No Authorization: Bearer … or X-API-Key header, or a typo in the header name (detail: Provide your API key as Authorization: Bearer ff_live_…).
  • Something other than a key in the header, such as quotes or a line break copied with it, a key cut short, or a placeholder left in (detail: The API key format is not recognised). A key is ff_live_ or ff_test_ followed by 20 to 64 letters and digits.
  • The key was revoked, or it had an expiry date that has passed. A revoked key can still work for up to a minute, because key lookups are cached for 60 seconds.
  • A key from another Formfeed environment, for example a staging key sent to production: there it is an unknown key.
  • The organisation of the key was deleted.

How to fix it​

  • Check the header: Authorization: Bearer ff_live_… (or ff_test_…), or X-API-Key: ff_live_….
  • Look the key up under API keys in the app: it shows whether the key is active and when it was last used.
  • Create a new key if the old one was revoked or expired. See Authentication.

Retry?​

No. Retrying the same request gives the same answer; send a valid key first.