Incorrect API key provided

The AI API rejected the key your code sent: it has a typo, was revoked, or isn’t the key you think the app is using.

Terminal and API response
AuthenticationError: 401 Incorrect API key provided: sk-proj-************************************************bb0A. You can find your API key at https://platform.openai.com/account/api-keys.

Also appears as

  • {"error":{"message":"Incorrect API key provided: sk-proj-************************************************bb0A. You can find your API key at https://platform.openai.com/account/api-keys.","type":"invalid_request_error","param":null,"code":"invalid_api_key"}}
  • OpenAIError: Missing credentials. Please pass an `apiKey`, `workloadIdentity`, `adminAPIKey`, or set the `OPENAI_API_KEY` or `OPENAI_ADMIN_KEY` environment variable.
  • OpenAIError: The OPENAI_API_KEY environment variable is missing or empty; either provide it, or instantiate the OpenAI client with an apiKey option, like new OpenAI({ apiKey: 'My API Key' }).
  • AuthenticationError: 401 {"type":"error","error":{"type":"authentication_error","message":"invalid x-api-key"},"request_id":"req_011CSHoEeqs5C35K2UUqR7Fy"}

Prompt to fix it

Calls to OpenAI fail with "401 Incorrect API key provided". Find where the app reads the API key and which environment variable it uses, and check every place that value could come from: .env files, the shell environment, and the hosting settings. Make sure the key is read only in server code, trimmed of stray quotes and spaces, and that a missing key fails with a clear error at startup. Tell me which value I need to replace. Don’t hardcode the key in source files, and don’t move the call into the browser.

Paste into Layerwise or any AI coding tool.

What it means

OpenAI checks the key on every request. This 401 means a key arrived and OpenAI doesn’t recognize it. The masked value in the message shows the key’s prefix and last four characters, which is the fastest way to see which key your code actually sent. Anthropic’s version of the same error is invalid x-api-key.

Often the key in the dashboard is fine and a different value reaches the code: an old key still loaded after you edited .env, quotes or a trailing space pasted into the host’s settings, or a production host that never got the new key. If the key is missing entirely, the SDK stops before sending anything, with the Missing credentials message.

A leftover OPENAI_API_KEY in your shell profile or system environment wins over .env files in Node, Next.js, and Vite, so editing .env changes nothing. Run echo $OPENAI_API_KEY in the same terminal to check. Keys also stop working when they’re revoked, which can happen automatically after one is published in a public repository.

Common causes

  • The key has a typo, a missing character, or quotes or spaces copied along with it.
  • The key was deleted, rotated, or revoked after it leaked in public code.
  • An old OPENAI_API_KEY in the shell or system environment overrides the new value in .env.
  • The production host still has an old key, or the app wasn’t redeployed after the key changed.
  • The code sends a key from another provider, such as an Anthropic or OpenRouter key, to OpenAI.

How to fix it

  1. Compare the masked key in the message with the keys listed on the API keys page of platform.openai.com.
  2. If none match, create a new secret key in the right project and copy all of it.
  3. Paste it into .env or your host’s environment settings with no quotes or spaces, then restart the dev server or redeploy.
  4. Run echo $OPENAI_API_KEY in your terminal. If it prints an old key, remove that line from your shell profile and open a new terminal.
  5. Keep the key in server-side code only, so it can’t leak and get revoked again.

Related errors

All errors
OpenAIError: It looks like you're running in a browser-like environment. This is disabled by default, as it risks exposing your secret API credentials to attackers. If you understand the risks and have appropriate mitigations in place, you can set the `dangerouslyAllowBrowser` option to `true`, e.g., new OpenAI({ apiKey, dangerouslyAllowBrowser: true }); https://help.openai.com/en/articles/5112595-best-practices-for-api-key-safety

It looks like you're running in a browser-like environment

The AI SDK refused to run in the browser, because your secret API key would be visible to anyone who opens the page.

RateLimitError: 429 You exceeded your current quota, please check your plan and billing details. For more information on this error, read the docs: https://platform.openai.com/docs/guides/error-codes/api-errors.

You exceeded your current quota

OpenAI refused the request because the account or project behind the API key is out of credit or has reached a spending limit.

GET https://api.example.com/items 401 (Unauthorized)

401 Unauthorized

The server couldn’t confirm who was calling: the request had no credentials, or its API key, session, or token was wrong or expired.

remote: error: GH013: Repository rule violations found for refs/heads/main. remote: remote: - GITHUB PUSH PROTECTION remote: ————————————————————————————————————————— remote: Resolve the following violations before pushing again remote: remote: - Push cannot contain secrets remote: remote: remote: (?) Learn how to resolve a blocked push remote: https://docs.github.com/code-security/secret-scanning/working-with-secret-scanning-and-push-protection/working-with-push-protection-from-the-command-line#resolving-a-blocked-push remote: remote: remote: —— OpenAI API Key ———————————————————————————————————— remote: locations: remote: - commit: 3f9c2a1d8e7b6c5a4f3e2d1c0b9a8f7e6d5c4b3a remote: path: .env:2 remote: remote: (?) To push, remove secret from commit(s) or follow this URL to allow the secret. remote: https://github.com/acme/my-app/security/secret-scanning/unblock-secret/2pXk9vQmT4bL7nRw1sYc8ZfHj3e remote: To https://github.com/acme/my-app.git ! [remote rejected] main -> main (push declined due to repository rule violations) error: failed to push some refs to 'https://github.com/acme/my-app.git'

GH013: Push cannot contain secrets

GitHub found an API key or other secret in the commits you tried to push and blocked the whole push so the secret wouldn’t land in the repository.

Build with an agent that checks its work

The Layerwise agent clicks through the live preview and reads the console, so it catches errors before you do.

DownloadRead the docs