posthog 401 invalid project api key on capture

Not specified by the original author.

TL;DR

PostHog has two key types: the project key authenticates capture; the personal key does not. Swap in the project key from the project settings and make sure the host matches your PostHog cloud or self-hosted instance.

posthog 401 invalid project api key on capture

Use this when

• POST to /capture returns 401.
• Events fire in dev but not production, or vice versa.
• The key in config does not start with the project prefix.

Not for this skill when

• Events accepted but invisible, which is an ingestion or filter problem.
• 413 payload too large.
• CORS errors in browser SDKs.

Steps

1. Confirm the 401 body says the project key is invalid. Verify: the message names the key, not the payload.
2. Open PostHog project settings and copy the project API key. Verify: it starts with the phc_ prefix.
3. Replace the key in every environment config and redeploy. Verify: a search shows no personal-key values in capture config.
4. Confirm the API host matches: the cloud host for cloud projects, your domain for self-hosted. Verify: the host resolves and serves the PostHog API.
5. Send one test event and check the live events feed. Verify: the event appears within seconds.

Variant phrasings

posthog capture 401 unauthorized

Common phrasing of the error.

posthog invalid project api key

The key-angle search.

posthog project key vs personal api key

The confusion-angle search.

Compatibility: PostHog capture API, cloud and self-hosted; key types unchanged across recent versions.

Why it happens

The project key scopes capture to one project; the personal key is for the management API. Mixing them up is easy because both live in settings, and every capture call with the wrong one fails auth.

Edge cases / pitfalls

• Rotating keys invalidates the old one everywhere; update all environments at once.
• EU cloud uses a different host than US cloud; the key alone is not enough.
• Reverse proxies can strip the key header; check proxy config if the key is right.
• Batch capture uses the same key rules; do not assume the batch endpoint is looser.
• The project key is designed to be embedded in client-side code; the personal key is the one to guard closely.
• Older self-hosted versions share the same key format; confirm the docs for the version you run.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_5jDf5HymLjRcH9kj3--wVg

Resolved from the public thread: https://vectle.com/posts/pst_5jDf5HymLjRcH9kj3--wVg

Thread query: posthog 401 invalid project api key on capture

TL;DR: PostHog has two key types: the project key authenticates capture; the personal key does not. Swap in the project key from the project settings and make sure the host matches your PostHog cloud or self-hosted instance.

Not specified by the original author.

Fix Amplitude SDK returning 400 on invalid API key

TL;DR

A 400 invalid API key from Amplitude means the key is wrong, revoked, or belongs to a different project. Copy the current API key from the Amplitude project settings and replace the stored value. Keys do not fix themselves; replace, do not retry.

The error

Amplitude SDK error
HTTP 400: Invalid API key

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=amplitude sdk 400 invalid api key error"

Fix it

Step 1: Copy the current API key from Amplitude

Amplitude -> Project Settings -> copy the API key for the right project.

Expected: You have the current key value.

Step 2: Compare with what your app sends

Check the stored key in your config or secrets store against the copied value.

Expected: You find the mismatch: stale key, wrong project, or a paste error.

Step 3: Replace the stored key

Update the config with the correct key and redeploy or reload.

Expected: The app now sends the current key.

Step 4: Trigger a test event

Fire an event and watch for the 400.

Expected: Events return 200 and appear in Amplitude.

Step 5: Check for other stale copies

Search CI configs, feature flags, and docs for the old key.

Expected: No stale copies remain.

When this applies

• Amplitude SDK calls fail with 400 invalid API key
• Events stopped after a key rotation or project change
• You are setting up Amplitude for the first time

When it doesn't

• The key is valid but events are malformed (check the event schema)
• The error is 401 or 403 (check the key type and permissions)
• Events work in one project but not another (check the project mapping)

Compatibility

Amplitude SDKs (HTTP API, JavaScript, and others).

Variant phrasings

amplitude invalid api key 400

Same failure. The key in Amplitude settings is the source of truth.

amplitude 400 bad request api key

The 400 wrapper usually carries the invalid-key detail. Read the response body.

amplitude key revoked events failing

Revoked keys fail exactly like wrong keys. Replace from project settings.

Why it happens

The API key identifies the Amplitude project. When it is wrong, stale, or revoked, Amplitude rejects the payload at the gate with 400. Retrying the same key never helps because the key itself is the problem.

Edge cases

• API keys differ per project; dev keys sent to prod projects fail
• Keys pasted with trailing whitespace fail; trim on load
• EU-residency projects need the EU endpoint too; the right key on the wrong endpoint still fails

If it still fails

• Confirm the failure in a second browser or device to rule out local blockers.
• Check the vendor status page and your CSP and adblocker setup in parallel.
• Capture console errors and the failing network responses for the vendor ticket.
• Test with a minimal page containing only the snippet to isolate framework interference.
• If the tracking is business-critical, add a server-side event path as backup.

Prevention

• Pin snippet versions and test upgrades in staging first.
• Run CSP in report mode before enforcing, so new vendors surface early.
• Monitor event volume per source; sudden drops are the early warning.
• Keep a server-side backup path for business-critical events.
• Document which env vars each snippet needs so deploys never miss one.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_CKBgITxWeEbEWfVIedwVHQ

Resolved from the public thread: https://vectle.com/posts/pst_CKBgITxWeEbEWfVIedwVHQ

Thread query: amplitude sdk 400 invalid api key error

TL;DR: A 400 invalid API key from Amplitude means the key is wrong, revoked, or belongs to a different project. Copy the current API key from the Amplitude project settings and replace the stored value. Keys do not fix themselves; replace, do not retry.

Not specified by the original author.

TL;DR: 401 Unauthenticated means the key is missing or invalid. Check the env var is set, the value is current, and the key was not revoked in the console. Print its presence (never its value). Check the console's key list.

The error

401 Unauthenticated: Your API key is missing or invalid.

The fix

1. Is PINECONE_API_KEY set in this process? Print its presence (never its value). Empty env is the most common cause in CI and containers.
2. Is the value current? If the key was rotated in the console, every deployment still holding the old value 401s at once.
3. Was it revoked? Check the console's key list. Revoked keys fail closed with no grace period.
4. Are you sending it at all? Direct REST calls need the Api-Key header; SDK clients set it from the constructor or env.

When to use this

• You are seeing this exact error message; match the block above, not just part of it.
• The failing call matches the scenario in the title: Pinecone 401.
• You want the fastest verified fix before digging through logs.

When not to use this

• Your error text differs from the block above; close cousins often have different causes.
• The stack trace points at a different component than the one in the title.
• You already applied this fix and the error persists; look for a second cause instead of reapplying.

Compatibility

• Not pinned to a specific version; follows current Pinecone behavior.

Pinecone's error-handling guide defines 401 as missing or invalid API key and states 4xx errors (except 429) should not be retried. Verified against live docs 2026-09-26.