private key value is not valid

Not specified by the original author.

TL;DR

Re-encrypt the variable after fixing it and re-run the build.

Steps

1. Download the private API key from App Store Connect in .p8 format and paste the entire file contents into the environment variable value, including the begin and end lines. A truncated or reformatted key is the usual cause. Re-encrypt the variable after fixing it and re-run the build.

When to use

You are seeing this: Download the private API key from App Store Connect in.p8 format and paste the entire file contents into the environment variable value, including the begin and end lines. Use this skill when you run into "Codemagic: App Store Connect private key value is not valid".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Stack Overflow #69510841 (accepted answer, 7 votes): the iOS signing step fails with APPSTORECONNECTPRIVATEKEY Provided value is not valid even though the key identifier and issuer ID are set. The accepted answer identifies the usual mistake: the private key value was not copied correctly.

Verified resolution: Download the private API key from App Store Connect in .p8 format and paste the entire file contents into the environment variable value, including the begin and end lines. A truncated or reformatted key is the usual cause. Re-encrypt the variable after fixing it and re-run the build.

Source URL: https://stackoverflow.com/questions/69510841/codemagic-app-store-connect-private-key-provided-value-is-not-valid

Not specified by the original author.

TL;DR: Then check the role of the user the key belongs to. Decide first whether your app is private or public. Private: log in, go to Settings > REST API, hit Create API key.

Fix

1. Then check the role of the user the key belongs to. Expected: this specific failure stops.

2. If you only need read-only access, fine, but if your agent needs to create tickets or change settings, generate the key under an admin user. Expected: this specific failure stops.

3. If you are building a public app you have to use OAuth2. Expected: this specific failure stops.

Details

Decide first whether your app is private or public. Private: log in, go to Settings > REST API, hit Create API key. Public: build the OAuth2 flow instead, keys will not cut it. Quick smoke test after setup: GET YOUR_HOST.gorgias.com/api/account with the key. 403s on endpoints you expect to work usually mean the key's user role is too narrow, not that the endpoint is broken. Context: Official docs (Access Tokens / API Keys): documents that API key authentication works only for private apps. It also documents that each access token is tied to a specific user and inherits that user's permissions, so a key generated for an Observer-role user can only do what that role can. Agents often grab a key and assume full admin access, then get confusing 403s.

When to use

You hit exactly this: Gorgias API keys only work for private apps; public apps must use OAuth2 in Gorgias API.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

Gorgias API.

Source: Official docs (Access Tokens / API Keys): documents that API key authentication works only for private apps. If you are building a public app you have to use OAuth2. It also documents that each access token is tied to a specific user and inherits that user's permissions, so a key generated for an Observer-role user can only do what that role can. Agents often grab a key and assume full admin access, then get confusing 403s.

Verified resolution: Decide first whether your app is private or public. Private: log in, go to Settings > REST API, hit Create API key. Public: build the OAuth2 flow instead, keys will not cut it. Then check the role of the user the key belongs to. If you only need read-only access, fine, but if your agent needs to create tickets or change settings, generate the key under an admin user. Quick smoke test after setup: GET https://YOUR_SUBDOMAIN.gorgias.com/api/account with the key. 403s on endpoints you expect to work usually mean the key's user role is too narrow, not that the endpoint is broken.

Source URL: https://developers.gorgias.com/docs/access-tokens-api-keys

Not specified by the original author.

Brave Search API auth: X-Subscription-Token header, not Bearer

TL;DR

Authenticate Brave Search API calls like this: curl "https://api.search.brave.com/res/v1/web/search?q=..." \ -H "X-Subscription-Token - YOUR_KEY" \ -H "Accept: application/json" \ -H "Accept-Encoding: gzip" Three common auth mistakes: 1. Using your auth header Brave does not read that header; you will get an auth error on a perfectly good key. Putting the key in ?apikey value or similar query params.

Use this when you run into the situation in the title.

When not to use this skill: unrelated tasks. It covers only the procedure above.

Compatibility

The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

Details

2. Not supported, and it leaks the key into logs. 3. Rotating the key when the real problem is a 422 VALIDATION error (bad parameter). Fix params before burning keys; key burns persist until the next calendar month. Get the key from the dashboard after subscribing to a plan; a credit card is required even for the free subscription.

Context: Docs (Brave Search API dashboard documentation, mirrored 2026-02-07): every API request must include your subscription token in the X-Subscription-Token HTTP request header to authenticate and authorize access. Obtaining a key requires subscribing to a plan first (even the free plan needs a subscription, though it is not charged), then creating the key under API Keys in the dashboard. The docs stress the key is confidential and must never appear in client-side code or public repos. Agents defaulting to your auth header an ?apikey value query parameter get auth failures on perfectly good keys.

Source: Docs (Brave Search API dashboard documentation, mirrored 2026-02-07): every API request must include your subscription token in the X-Subscription-Token HTTP request header to authenticate and authorize access. Obtaining a key requires subscribing to a plan first (even the free plan needs a subscription, though it is not charged), then creating the key under API Keys in the dashboard. The docs stress the key is confidential and must never appear in client-side code or public repos. Agents defaulting to your auth header an ?apikey value query parameter get auth failures on perfectly good keys.

Verified resolution: Authenticate Brave Search API calls like this: curl "https://api.search.brave.com/res/v1/web/search?q=..." \ -H "X-Subscription-Token - YOUR_KEY" \ -H "Accept: application/json" \ -H "Accept-Encoding: gzip" Three common auth mistakes: 1. Using your auth header Brave does not read that header; you will get an auth error on a perfectly good key. 2. Putting the key in ?apikey value or similar query params. Not supported, and it leaks the key into logs. 3. Rotating the key when the real problem is a 422 VALIDATION error (bad parameter). Fix params before burning keys; key burns persist until the next calendar month. Get the key from the dashboard after subscribing to a plan; a credit card is required even for the free subscription.

Source URL: https://github.com/amal-david/docingest/blob/HEAD/server/storage/docs/api-dashboard.search.brave.com/documentation_2026-02-07T03:57:54.021Z.md