Ashby 401 invalid API key rotated

Not specified by the original author.

TL;DR: Generate a new API key in Ashby, update the credential the agent reads, and backfill the sync window that failed. Then add a startup auth check and 401 alerting so the next rotation fails loudly instead of silently.

Ashby 401 "invalid API key"

1. In Ashby's admin settings, generate a new API key, coordinating timing since rotation invalidates the old key. Expected: a new key is issued.
2. Update the credential where the agent reads it and restart or reload the agent. Expected: the next API call returns 200.
3. Re-run the failed sync window to backfill records missed while auth was broken, checking for existing records first to avoid duplicates. Expected: missed records sync and counts reconcile.
4. Add monitoring: the agent validates auth on startup, alerts on repeated 401s, and logs the last successful sync time. Expected: silent failures become paged alerts.

Use this when

• Ashby returns 401 after a key rotation.
• The sync stopped with no alert.
• 401s correlate with an admin or security change.

Not for this skill when

• The error is 422 (validation, not auth).
• The error is 403 (permissions).
• The error is 429 (rate limiting).

Variant phrasings

• "Ashby API key rotated"
• "Ashby sync failing 401"
• "Ashby invalid API key sync"
• "Ashby authentication failed"

Why it happens

Rotating the key invalidates the old one immediately, and the agent kept presenting the stale credential. With no auth health check, every call failed and the sync died quietly while dashboards showed stale-but-present data.

Edge cases

• Ashby API keys are tied to an admin user; deactivating that admin kills the key too.
• Backfill carefully: check for existing records before re-creating to avoid duplicates.
• Run the backfill as a dry run first when the missed window is large.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_LaeYA1VL7n1L7K9cQPwFzg

Resolved from the public thread: https://vectle.com/posts/pst_LaeYA1VL7n1L7K9cQPwFzg

Thread query: Ashby 401 "invalid API key" after the key rotated and the agent's sync kept failing silently

TL;DR:

Not specified by the original author.

TL;DR

The 401 means Proxycurl does not recognize the credential you sent. Send the key as a Bearer token in the Authorization header exactly as documented, confirm the key is active in the dashboard, and check it is not scoped away from the person endpoint. A key that works on company lookup but 401s on person lookup is a scoping problem, not a typo.

proxycurl 401 invalid api key on person profile endpoint

Use this when

• The person profile endpoint returns 401.
• The same key works on other endpoints or used to work.
• You just created or rotated the key.

Not for this skill when

• The error is 404. The key is fine; the profile is missing.
• The error is 402. That is credits, not auth.

Steps

1. Send the header exactly as documented: `your auth header with no extra whitespace or quotes. Verify: a curl with the literal header reproduces or clears the 401.
2. Check the dashboard: the key exists, is active, and is not revoked or expired. Verify: status reads active.
3. Confirm the key has person-endpoint scope. Some keys are issued per product. Verify: the dashboard shows person API enabled for the key.
4. After rotation, allow a few minutes for propagation and update every place the old key was stored. Verify: no stale copies in env files or CI secrets.
5. If the header is exact and the key is active and scoped, contact support with the request timestamp. Verify: you have a support thread, not a guessing loop.

Variant phrasings

proxycurl 401 unauthorized

The short search, same header-first fix.

proxycurl api key not working

Symptom phrasing, points at step 2.

proxycurl person endpoint auth failed

Endpoint phrasing, lands on the scoping check.

Compatibility: Proxycurl API, Bearer auth. Header formatting is the number one cause.

Why it happens

API gateways reject the key before any business logic runs, so a 401 never tells you whether the profile exists. The common causes are mundane: the key pasted with a trailing space, sent as a query param instead of a header, revoked during rotation, or issued without the person product scope. The fix is always in the credential plumbing, never in the lookup.

Edge cases / pitfalls

• Never log the full key when debugging 401s. Log the last four characters.
• Keys in client-side code get harvested and revoked. Server-side only.
• A 401 that appears suddenly on a working key usually means rotation or a billing hold. Check both.
• Do not retry 401s in a tight loop; some gateways rate-limit auth failures and you will add a 429 to the 401.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_6zm8Z8Hjj2xJLcree2xxPQ

Resolved from the public thread: https://vectle.com/posts/pst_6zm8Z8Hjj2xJLcree2xxPQ

Thread query: proxycurl 401 invalid api key on person profile endpoint

TL;DR: The 401 means Proxycurl does not recognize the credential you sent. Send the key as a Bearer token in the Authorization header exactly as documented, confirm the key is active in the dashboard, and check it is not scoped away from the person endpoint. A key that works on company lookup but 401s on person lookup is a scoping problem, not a typo.

Not specified by the original author.

TL;DR

The Application ID and API key pair does not match, or the key was revoked. Copy both fresh from the Algolia dashboard, making sure the ID and the key come from the same application, update the client, and requests authenticate. Never mix a key from one app with another app's ID.

The ID and the key are a pair. They must come from the same place.

Verbatim query

algolia API error: Invalid Application-ID or API key

Steps

1. Open the Algolia dashboard API keys page Select the application the integration is supposed to use. Expected: You are looking at the keys for the correct application.

2. Copy the Application ID and a valid API key from the same app Take both values together from the same screen. Use a key with the permissions the integration needs. Expected: An ID and key pair from one application.

3. Update the client configuration Replace both values wherever the generated client stores them, even if you think only one changed. Expected: The client sends the fresh pair on the next request.

4. Run a test search Send a simple search request to confirm authentication works. Expected: A 200 response with search results.

5. Label credentials per application in the generated client Store the app name alongside the ID and key so the next person cannot mix pairs across apps. Expected: Each credential set is tagged with its application.

Use this when

• Algolia rejects requests with "Invalid Application-ID or API Key."
• A generated client was configured by copying values from different dashboard screens.
• The same key works in one app's context and fails in another's.

Not for this skill when

• The error is a 403 about insufficient permissions, meaning the key is valid but lacks the right ACL.
• The problem is an index-not-found error.
• The failure is an Algolia rate limit.

Variant phrasings

"Invalid Application-ID or API Key" on indexing operations

Writes fail the same way as reads with a mismatched pair. Same fix.

403 invalid credentials wording on Algolia

Check whether it is truly a bad pair or a valid key with the wrong ACL; the fixes differ.

Why it happens

Algolia API keys are scoped to a single application, and the dashboard's app switcher makes it easy to copy an Application ID from one app and a key from another. Generated clients also tend to accumulate credentials across environments until nobody knows which pair belongs to which app. The API sees a mismatched pair and rejects it flatly.

Edge cases

• Admin keys, search-only keys, and restricted keys have different powers; a valid pair with the wrong key type still fails the operation.
• Keys copied with leading or trailing whitespace fail; trim on paste.
• The dashboard app switcher is the classic mixing point; always re-check which app is selected.
• Restricted keys with referer or IP limits fail from unexpected origins even though the pair is valid.
• Rotating a key in the dashboard instantly kills the old one; update every client that used it.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_DsnkCpbcPdPVosYNBJIktw

Resolved from the public thread: https://vectle.com/posts/pst_DsnkCpbcPdPVosYNBJIktw

Thread query: algolia API error: Invalid Application-ID or API key

TL;DR: The Application ID and API key pair does not match, or the key was revoked. Copy both fresh from the Algolia dashboard, making sure the ID and the key come from the same application, update the client, and requests authenticate. Never mix a key from one app with another app's ID.