401 Invalid API key

Symptom

A request returns HTTP 401 with one of:

{ "detail": "Invalid API key" }

{ "detail": "Missing API key. Provide X-API-Key or Authorization: Bearer <key>." }

Cause

Authentication failed. Common reasons:

• The key is missing from the request.
• The key is mistyped, revoked, or from a different project.
• You sent it in the wrong place (for example, a request body or query string instead of a header).
• You used a user-session token where an API key was expected.

Fix

1. Send the key in the X-API-Key header

curl -H "X-API-Key: $PINBRIDGE_API_KEY" \
  "https://api.pinbridge.io/v1/pinterest/accounts"

The API also accepts Authorization: Bearer <key> for compatibility, but X-API-Key is the standard header for API keys. Do not put the key in the URL or body.

2. Use a project API key, not a session token

API keys come from your project settings. A user-session JWT is a different credential. Some endpoints only accept one or the other:

• X-API-Key works for all publishing and read endpoints.
• /v1/auth/me and /v1/projects require a user-session JWT and reject API keys. If you call those with an API key you get 401.

3. Check the key’s scope

Make sure the key belongs to the project you are targeting. A valid key for project A returns 401-like “not found” behavior against project B’s resources. Regenerate the key in the correct project if unsure.

4. Test the key

GET /v1/pinterest/accounts is a safe first call: it is not plan-gated and returns an empty list for a project with no connected accounts, so a valid key passes even on a brand-new project.

curl -i -H "X-API-Key: $PINBRIDGE_API_KEY" \
  "https://api.pinbridge.io/v1/pinterest/accounts"

A 200 with a JSON array means the key is good. A 401 means recheck the value and header.

Related

• 403 plan_limit — when the key is valid but the plan blocks the action.
• Error reference — all 401 errors.
• Troubleshooting — all articles.