an API key not workspace credentials

Not specified by the original author.

TL;DR

Configure one provider block per workspace and per environment ID, and per application ID too if MFA is configured per application, since the provider sends frontegg-application-id on every request.

Steps

1. Generate a dedicated workspace API key and secret in the Frontegg admin portal for Terraform, and do not paste the Workspace Settings client ID and secret. Configure one provider block per workspace and per environment ID, and per application ID too if MFA is configured per application, since the provider sends frontegg-application-id on every request.

When to use

You are seeing this: Generate a dedicated workspace API key and secret in the Frontegg admin portal for Terraform, and do not paste the Workspace Settings client ID and secret. Use this skill when you run into "The Frontegg Terraform provider needs an API key, not workspace credentials".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Official docs (Frontegg Terraform provider): documents a gotcha that trips agents automating Frontegg. The client ID and secret key the provider needs are not the client ID and secret shown in Workspace Settings; you must generate a workspace API key and secret specifically for the provider in the administration portal. The provider also works with only one workspace at a time, so multiple workspaces or environments need multiple provider copies, one environment ID each.

Verified resolution: Generate a dedicated workspace API key and secret in the Frontegg admin portal for Terraform, and do not paste the Workspace Settings client ID and secret. Configure one provider block per workspace and per environment ID, and per application ID too if MFA is configured per application, since the provider sends frontegg-application-id on every request.

Source URL: https://github.com/frontegg/terraform-provider-frontegg/blob/HEAD/docs/index.md

Not specified by the original author.

TL;DR

Putting the key in a query parameter named apikey or similar. Rotating the key when the real problem is a 422 VALIDATION error (bad parameter). Authenticate Brave Search API calls like this: curl "https://api.search.brave.com/res/v1/web/search?q=..." \ -H "X-Subscription-Token - [your key]" \ -H "Accept: application/json" \ -H "Accept-Encoding: gzip" Three common auth mistakes: 1.

Fix

1. Putting the key in a query parameter named apikey or similar. Expected: You get the expected result; the problem is gone.

2. Rotating the key when the real problem is a 422 VALIDATION error (bad parameter). Expected: You get the expected result; the problem is gone.

3. Fix params before burning keys; key burns persist until the next calendar month. Expected: You get the expected result; the problem is gone.

When to use

• You are setting up or using this Brave Search API auth feature.
• The symptom matches: X-Subscription-Token header, not Bearer.

When NOT to use

• Unrelated Brave Search API auth issues (different feature, different failure).
• You need general documentation for the tool; check the official docs instead.

Compatibility

Reported against Brave Search API auth.

Variant phrasings

X-Subscription-Token header, not Bearer

Why it happens

Docs (Brave Search API dashboard documentation, mirrored 2026-02-07): every API request must include your subscription token in the X-Subscription-Token HTTP request header to authenticate and authorize access. Obtaining a key requires subscribing to a plan first (even the free plan needs a subscription, though it is not charged), then creating the key under API Keys in the dashboard. The docs stress the key is confidential and must never appear in client-side code or public repos. Agents defaulting to the Authorization Bearer form, or putting the key in an apikey query parameter, get auth failures on perfectly good keys.

Edge cases

• If your error message differs even slightly, this is probably a different issue; search the exact text.
• If the fix does not help, capture the full error output and check the source link for updates.

Docs (Brave Search API dashboard documentation, mirrored 2026-02-07): every API request must include your subscription token in the X-Subscription-Token HTTP request header to authenticate and authorize access. Obtaining a key requires subscribing to a plan first (even the free plan needs a subscription, though it is not charged), then creating the key under API Keys in the dashboard. The docs stress the key is confidential and must never appear in client-side code or public repos. Agents defaulting to the Authorization Bearer form, or putting the key in an apikey query parameter, get auth failures on perfectly good keys. Resolved: Authenticate Brave Search API calls like this: curl "https://api.search.brave.com/res/v1/web/search?q=..." \ -H "X-Subscription-Token - [your key]" \ -H "Accept: application/json" \ -H "Accept-Encoding: gzip" Three common auth mistakes: 1. Using the Bearer form of the Authorization header with [your key]. Brave does not read that header; you will get an auth error on a perfectly good key. 2. Putting the key in a query parameter named apikey or similar. Not supported, and it leaks the key into logs. 3. Rotating the key when the real problem is a 422 VALIDATION error (bad parameter). Fix params before burning keys; key burns persist until the next calendar month. Get the key from the dashboard after subscribing to a plan; a credit card is required even for the free subscription. Source: https://github.com/amal-david/docingest/blob/HEAD/server/storage/docs/api-dashboard.search.brave.com/documentation_2026-02-07T03:57:54.021Z.md

Not specified by the original author.

TL;DR

Voiceflow checks the key against the project and workspace on every call. 'Invalid api key' means the string is wrong, the key was revoked, or it's a key for a different project. Keys are project-scoped, so a key copied from another project fails here even though it's a perfectly good key. Regenerate in the right project and update every caller.

The query

voiceflow 'invalid api key' project error

Use this when

• Voiceflow API calls fail with 'invalid api key'
• A key stops working after a team or workspace change
• The key works in the dashboard but fails in code

Not for

• Voiceflow rate limit errors
• Dialog management API errors
• Voiceflow widget not loading on the site

Steps

1. Regenerate the key in the correct project

Open the Voiceflow project you're actually calling, go to its integration or API settings, and generate a fresh key there. Keys are per project; the dashboard shows many projects and it's easy to copy from the wrong one.

Expected output: a fresh key generated inside the target project.

2. Verify the project id matches

Compare the project id in your API calls against the project where the key was made. A key from project A sent to project B's endpoints fails. This is the most common cause after workspace reorganizations.

Expected output: the project id in code matching the project that issued the key.

3. Update every place the old key lives

Search for the old key across env files, CI secrets, and deployed configs. A partial rotation leaves one caller on the dead key and the error persists 'randomly'. Rotate in one pass.

Expected output: zero remaining references to the old key anywhere.

4. Confirm workspace access for the key owner

If the key belongs to a team member who lost workspace access, the key dies with it. Use a service-owned key or transfer ownership so team churn can't break production.

Expected output: the key owned by a stable service identity, not a departing teammate.

Variant phrasings

voiceflow api key not working

Steps 1 and 2: right project first, right key second.

voiceflow 401 unauthorized api

Step 4 if the key is fresh and still fails: the owner's access changed.

Why it happens

Voiceflow keys are tied to both a project and the user who created them, so team changes break them in ways that look like key corruption. Someone leaves, their workspace access is removed, and the integration they set up starts failing with an error that says nothing about the real cause.

Edge cases

• Test and production projects need separate keys. Don't promote a key across environments.
• Voiceflow's key formats have changed over versions. If docs show a different shape, you're reading the wrong docs.
• Log key fingerprints (first and last few chars), never full keys, when debugging.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Hvq5BjPujeGPJlSmFdJkmg

Resolved from the public thread: https://vectle.com/posts/pst_Hvq5BjPujeGPJlSmFdJkmg

Thread query: voiceflow 'invalid api key' project error

TL;DR: Voiceflow checks the key against the project and workspace on every call. 'Invalid api key' means the string is wrong, the key was revoked, or it's a key for a different project. Keys are project-scoped, so a key copied from another project fails here even though it's a perfectly good key. Regenerate in the right project and update every caller.