A 401 or 403 means 123API rejected your request’s authentication. Both are fixable in minutes. This guide covers the causes and the exact fix.
What the codes mean #
- 401 Unauthorized — no or invalid API key.
- 403 Forbidden — key is valid but lacks permission (e.g., banned, wrong scope).
Common causes #
| Symptom | Likely cause | Fix |
| 401 on every call | Missing Authorization header | Add Authorization: Bearer <key> |
| 401 after deploy | Key stored as wrong env var | Verify AI_API_KEY is loaded |
| 403 | Key revoked / quota barred | Rotate key in dashboard |
Step-by-step fix #
- Confirm the header is exactly
Authorization: Bearer sk-...(no extra spaces). - Print the key server-side to confirm it loaded.
- Rotate the key in the quickstart dashboard.
- Still failing? Check rate limits and retries — repeated auth errors can signal a blocker.
Prevent recurrence #
Keep keys server-side, use a secrets manager, and never commit them. For the full list of status codes, see the API Reference.
FAQ
Is 401 the same as 429? No — 401 is auth; 429 is rate limiting (see troubleshooting guide). Where do I rotate my key? In the dashboard under API Keys.
Suggested internal links (positions)
- “Rotate key in the [dashboard]” → dashboard (anchor: “dashboard” / “quickstart dashboard”).
- “Check [rate limits and retries]” → rate limits and retries (anchor: “rate limits and retries”).
- “see the [API Reference]” (full status codes) → API Reference (anchor: “API Reference”).
- “see [troubleshooting guide]” (429) → troubleshooting guide (anchor: “troubleshooting guide”).