Greenhouse 400 "invalid harvest api key format" - the agent sent the key with the wrong prefix

Greenhouse 400 "invalid harvest api key format" - the agent sent the key with the wrong prefix

TL;DR

The agent sent the Harvest key with the wrong shape: a missing prefix, extra whitespace, or the wrong key type entirely. Compare the sent value against the Greenhouse docs format, fix the construction, and store the key where the agent reads it verbatim. Format errors are always in how the key was assembled or stored.

400 Bad Request: "invalid harvest api key format"

Steps

1. Inspect what the agent actually sends: log the key's shape (length, prefix, characters), never the full value. Expected: The malformation is visible (wrong prefix, whitespace, truncation).

2. Compare against the documented Harvest key format for your key type. Expected: You know what correct looks like.

3. Fix the construction: strip whitespace, restore the prefix, or regenerate the key if it was mangled in storage. Expected: The sent key matches the documented format.

4. Store the key so the agent reads it verbatim: no templating, no concatenation, no shell interpolation. Expected: Storage stops mangling the key.

5. Test with a harmless read (list jobs) before resuming writes. Expected: The key works before it matters.

When to use

• Greenhouse 400s on "invalid harvest api key format"
• the key was recently rotated or re-stored
• the agent assembles the key from parts

When not to use

• the error is 401 (the key is well-formed but wrong or revoked)
• the key works from curl but not the agent (compare the exact sent bytes)
• the docs format changed (check the changelog)

Tool compatibility

• Greenhouse Harvest API
• key management

Variant phrasings

• "greenhouse invalid harvest api key format"
• "harvest api key format 400"
• "greenhouse key prefix wrong"

Why it happens

API keys have a precise format, and every layer between the vault and the request can mangle it: templating adds characters, env files add quotes, copy-paste adds whitespace. The 400 names the format because the server cannot even parse what it received. The fix is always between storage and send.

Edge cases

• never log the full key; log its shape
• rotated keys need atomic updates everywhere the old key lived
• test keys and prod keys can have different formats; do not mix them

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_0oD9Iw-cFgs8OASD3bx50A