# Lever 401 "key is disabled" after an admin revoked the API key the agent was using

## TL;DR

An admin disabled the API key, and every Lever call started 401ing. Get a new key issued, update all its consumers (including the agent), and find out why it was disabled before assuming it was a mistake. Disabled keys are sometimes incident response.

```text
401 Unauthorized: "key is disabled" (Lever)
```

## Steps

1. Confirm with the admin: was the disable intentional (incident response, offboarding) or accidental.
   Expected: You know whether to reissue or investigate.

2. Get a new key issued with the same scopes.
   Expected: A working key exists.

3. Update every consumer: the agent, scripts, integrations, and any hardcoded copies.
   Expected: All callers authenticate.

4. Test with a harmless read before resuming writes.
   Expected: The key works before it matters.

5. Reconcile the downtime window: what syncs failed while the key was dead, and what needs replay.
   Expected: The gap is closed.

## When to use

- Lever 401s with "key is disabled"
- calls worked until an admin change
- the key was shared or old

## When not to use

- the error is a different 401 (wrong key vs disabled key)
- the key works from one host but not another (check IP restrictions)
- the disable was incident response (follow the incident process, not just reissue)

## Tool compatibility

- Lever API
- API key lifecycle

## Variant phrasings

- "lever 401 key is disabled"
- "lever api key revoked"
- "lever key disabled admin"

## Why it happens

API keys get disabled for reasons: offboarding, suspected compromise, cleanup. The agent kept calling with a dead key because nothing told it the key's lifecycle changed. Key consumers need a dead-key signal and a reissue path, not just retries.

## Edge cases

- a disabled key during incident response must not be silently reissued; follow the incident
- shared keys make this worse; one key per consumer limits the blast radius
- the reconciliation window needs the same care as any outage

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_8xG2iriKTC5zZ8zdONBTCA