| 401 | | |
INVALID_CREDENTIALS | The key doesn’t exist, was copied wrong, or is revoked — the message is the same generic one (“Invalid API key”) in all three cases, to avoid giving hints to anyone trying to guess keys. | Check that you copied the full key with no spaces. If you revoked it yourself, create a new key (section 4/5). |
| 401 | | |
TOKEN_EXPIRED | The key passed its expiration date (section 8). | Create a new key; if you need it to never expire, choose “Never” when creating it. |
| 401 | | |
INVALID_CREDENTIALS (“Origin not allowed”) | The key has restricted origins (section 6) and the request arrives from a browser on a domain that isn’t on the list. | Add that domain to the key’s allowed-origins list, or use an unrestricted key for server-to-server calls. |
| 403 | | |
PERMISSION_DENIED | The key is attempting an action its sealed role doesn’t cover — for example, a personal key belonging to an editor or viewer role calling an admin-only route, or requesting to create/list company keys without being admin (“Only admins can create/list tenant-owned API keys”). | Use a key with sufficient permissions (a company key, or an admin’s personal one) for that specific action. |
| 429 | | |
RATE_LIMIT_EXCEEDED | The key’s quota has been exceeded (120 requests/minute by default, section 11) or some other quota that applies to the request. | Wait for the next minute and reduce your call frequency; if your integration needs more quota on a sustained basis, contact your provider. |
