What this error means

401 Incorrect API key provided means the API or AI coding tool rejected the request because credentials, model access, quota, context size, or provider configuration does not match the request being sent.

Why this happens

OpenAI-compatible tooling usually has three moving parts: API key, selected model, and request size.

For OpenAI API invalid API key, debug the smallest request that uses the same provider, model, and environment variable.

Common causes

  • API key is missing from the environment
  • API key was copied with extra whitespace
  • Application is reading the wrong environment variable
  • Key was revoked or belongs to a different project

Quick fixes

  1. Verify the API key is present without printing its value.
  2. Check the configured model name and provider/base URL.
  3. Create or copy the correct API key, set it in the expected environment variable, restart the app, and retry the request.
  4. Retry with a minimal request before rerunning the full app or editor workflow.

Copy-paste commands

Check whether the key is set

printf "OPENAI_API_KEY=%s\n" "${OPENAI_API_KEY:+set}"

Send a minimal API request

curl https://api.openai.com/v1/models \
  -H "Authorization: Bearer $OPENAI_API_KEY"

Inspect app environment without exposing the key

env | grep -E "OPENAI|MODEL|BASE_URL" | sed "s/=.*/=<redacted>/"

Platform-specific fixes

CI/CD

  • Set API keys as CI secrets, then restart or rerun the job so the process reads the updated environment.

Real-world fixes

  • If a tool works in one editor window but not another, compare provider settings and restart the editor.
  • If a model fails but authentication works, test a known available model before changing application code.
  • Create or copy the correct API key, set it in the expected environment variable, restart the app, and retry the request.

Step-by-step troubleshooting

  1. Record the request path, model, and 401 Incorrect API key provided without logging secret values.
  2. Verify OPENAI_API_KEY or the provider-specific key exists in the process that sends the request.
  3. Send a minimal API request with curl to separate SDK bugs from account or credential issues.
  4. If the error mentions context, reduce prompt history and requested output tokens.
  5. If the error mentions quota or rate limits, reduce concurrency before requesting higher limits.

How to prevent it

  • Centralize model names and provider base URLs in configuration.
  • Add retry backoff for rate-limit errors, not for quota or credential errors.
  • Log request IDs and non-secret configuration for production debugging.