Invalid API Key provided
Stripe rejected the request because the API key it received doesn’t match any active key, often a placeholder, a typo, or a deleted key.
Also appears as
- Invalid API Key provided: pk_test_********************4242
- You did not provide an API key. You need to provide your API key in the Authorization header, using Bearer auth (e.g. 'Authorization: Bearer YOUR_SECRET_KEY'). See https://stripe.com/docs/api#authentication for details, or we can help at https://support.stripe.com/.
- Error: Neither apiKey nor config.authenticator provided
Prompt to fix it
My server calls to Stripe fail with "Invalid API Key provided: sk_test_****". Find where the Stripe client is created and which environment variable supplies the key. Check for placeholder values, stray quotes or whitespace, and code that reads the wrong variable or a publishable key. Tell me the exact variable name to set on our host, and remind me to redeploy. Make the app fail at startup with a clear message if the key is missing. Keep the secret key on the server only; never put it in browser code or commit it.
Paste into Layerwise or any AI coding tool.
What it means
Every request to Stripe’s API carries a secret key. This error means Stripe looked up the key it received and found no active key that matches. Stripe answers with HTTP 401, and the Node library throws a StripeAuthenticationError.
The message is a debugging clue: it hides most of the key but keeps the prefix and the last four characters. Compare those with the keys in your Stripe Dashboard. If the key ends in something like here or xxxx, the app is still using a placeholder from .env.example.
A missing key fails differently. Stripe’s API replies “You did not provide an API key,” and current versions of the Node library stop earlier with “Neither apiKey nor config.authenticator provided” as soon as you create the client. Either way, the server never received the variable.
Common causes
- The environment variable still holds a placeholder like
sk_test_your_key_here. - The key was rolled or deleted in the Dashboard, and the deployed app still uses the old value.
- The value picked up quotes or spaces, or lost characters at the end, when it was pasted into the host.
- The key was updated on the host, but the app wasn’t redeployed, so the running code has the old one.
How to fix it
- Note the prefix and last four characters in the error, and find the matching key in the Stripe Dashboard under Developers → API keys.
- Copy the current secret key with its copy button:
sk_test_for testing,sk_live_for real payments. - Paste it into the host’s environment variables without quotes or spaces, under the exact name the code reads, such as
STRIPE_SECRET_KEY. - Redeploy, since running deployments keep the old value.
- Keep secret keys on the server. Browser code should only use the publishable key (
pk_).
Related errors
All errorsNo such price
Stripe couldn’t find the price ID your code sent, because it belongs to the other mode, another account or sandbox, or isn’t a price ID at all.
401 Unauthorized
The server couldn’t confirm who was calling: the request had no credentials, or its API key, session, or token was wrong or expired.
Incorrect API key provided
The AI API rejected the key your code sent: it has a typo, was revoked, or isn’t the key you think the app is using.
GH013: Push cannot contain secrets
GitHub found an API key or other secret in the commits you tried to push and blocked the whole push so the secret wouldn’t land in the repository.
Build with an agent that checks its work
The Layerwise agent clicks through the live preview and reads the console, so it catches errors before you do.