'Invalid publishable key' or Backend API 401: publishable key and secret key are swapped

Not specified by the original author.

Symptom

Either the frontend fails with an invalid-key error, or Backend API calls return 401, right after keys were pasted or rotated.

Confirm the cause

1. Publishable keys start with pk and belong on the frontend: ClerkProvider and NEXTPUBLIC_ variables. They are safe to expose.
2. Secret keys start with sk and belong ONLY on the backend, for createClerkClient and direct Backend API calls. A secret key in a NEXTPUBLIC_ variable ships it to every browser.
3. If the frontend complains: you likely pasted a secret key into the publishable slot, or there is a typo or stray whitespace.
4. If the Backend API 401s: you likely passed the publishable key where the secret key belongs.
5. Both keys must come from the SAME instance. A pktest key paired with an sklive key never works.

Fix

• Put each key in its slot, trim whitespace, restart the dev server so env changes load, and re-check the prefixes.

Verify

The frontend loads Clerk with no key error, and a Backend API call (for example fetching the user list) returns 200 with the secret key.

Verified against Clerk deployment docs 2026-09-26: the publishable key (pktest in development, pklive in production) is passed to ClerkProvider during initialization; the secret key (sktest/sklive) is used to access the Backend API. Forgetting to switch keys per environment is the documented common mistake.