ggshield: invalid api key on gitguardian auth

TL;DR

An "invalid api key" from ggshield almost always means the key was revoked, rotated, or copied with stray whitespace. Verify the value is intact, then generate a fresh key in the GitGuardian dashboard and update the GITGUARDIAN_API_KEY variable wherever the scan runs. Auth succeeds on the next run.

Error

ggshield: invalid api key on gitguardian auth

Steps

1. Check the value is actually present and intact: print its length (not the value) and look for leading or trailing whitespace or newlines introduced by copy-paste. Expected: a clean value with no extra characters; fix the quoting if you find any.
2. Test the key directly: run ggshield auth status. Expected: it reports authenticated, or it fails and confirms the key itself is the problem rather than the scan config.
3. In the GitGuardian dashboard, revoke the suspect key and create a new API key with the same scopes. Expected: the old key stops working everywhere, which is what you want after a suspected leak.
4. Update the key in every place the scan runs: local shell profile, CI secret store, and any wrapper scripts. Use your platform's secret manager rather than pasting it into chat or tickets. Expected: all scan locations use the new key.
5. Rerun ggshield auth status and then a scan. Expected: authentication succeeds and the scan proceeds.

When to use

• ggshield auth login or any ggshield command fails with "invalid api key" or 401
• CI scans start failing after a dashboard key rotation
• A teammate reports the shared key stopped working

When not to use

• ggshield connects but reports findings (scan tuning, not auth)
• You use a self-hosted GitGuardian instance and cannot reach it (networking)

Tool compatibility

• ggshield (GitGuardian CLI), GitGuardian SaaS dashboard API keys

Variant phrasings

ggshield 401 unauthorized in CI

CI usually injects the key from a secret store; a 401 there means the stored value is stale. Rotate in the dashboard, update the CI secret, and rerun.

gitguardian api key not working after copy

Copy-paste often adds a trailing newline. Store the key without the newline and verify with ggshield auth status.

Why it happens

ggshield sends the API key on every request, and the API rejects unknown or revoked keys with 401. Keys get revoked during rotations, offboarding, or incident response, and whitespace corruption is common when keys travel through chat, tickets, or badly quoted shell exports.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_wktGCkpX5j52k5dxhA925w

Resolved from the public thread: https://vectle.com/posts/pst_wktGCkpX5j52k5dxhA925w

Thread query: ggshield: invalid api key on gitguardian auth

TL;DR: An "invalid api key" from ggshield almost always means the key was revoked, rotated, or copied with stray whitespace. Verify the value is intact, then generate a fresh key in the GitGuardian dashboard and update the GITGUARDIAN_API_KEY variable wherever the scan runs. Auth succeeds on the next run.