AI APIsAPI keysEnv vars

401 Incorrect API key provided / authentication_error

401 Incorrect API key provided: sk-proj-****. You can find your API key at https://platform.openai.com/account/api-keys.

In short: The API received a key, but it's wrong, revoked, from another org/project, or mangled.

Why it happens

Typical causes: copying the key with a trailing space or newline; quotes inside the env value; a revoked key (providers revoke keys detected in public repos); mixing providers (an OpenAI key sent to Anthropic, or vice versa); or the env var not loading, so the SDK sends an old value from your shell.

How to fix it

1. Generate a fresh key in the provider dashboard and paste it carefully into .env.local without quotes or trailing spaces.
2. Check the variable name matches what the SDK expects (OPENAI_API_KEY, ANTHROPIC_API_KEY, etc.).
3. Restart the dev server; on your host, update the variable and redeploy.
4. Check for an older value exported in your shell (echo $OPENAI_API_KEY | cut -c1-8) overriding the file.
5. If the key was ever committed to a public repo, assume it was revoked and rotate.

Copy-paste fix prompt

I'm getting this error in my app:

401 Incorrect API key provided: sk-proj-****. You can find your API key at https://platform.openai.com/account/api-keys.

[Paste the full error, stack trace, and the file it points to here]

Likely cause: The API received a key, but it's wrong, revoked, from another org/project, or mangled.

Task: Trace how the API key gets from env to the SDK client in this project (file, variable name, loader, server vs. client) and point out anywhere it could be missing, mis-named, or exposed. Don't print the key.

Rules:
- First explain the root cause in 2 sentences and list the files you'll change.
- Make the smallest change that fixes it. Don't refactor unrelated code.
- Don't disable security or checks (RLS, auth, signature verification, type checking, CORS allow-all) to make the error disappear.
- Never print or hard-code secret keys.
- Finish by telling me exactly how to verify the fix.

Common with: Cursor, Replit, Bolt, Claude Code. Last reviewed 2026-11-13.