Symptom: 401 restricted_api_key ("This API key is restricted to only send emails") or 403 "API key is not active" on calls where the key itself is correct.
1. Confirm the cause: Resend API keys carry a permission chosen at creation: Sending access (send emails only) or Full access (create, delete, get, and update any resource). A Sending-access key works for the send endpoint and fails everywhere else. That is the 401, not a bad key.
2. Fix: on the API keys dashboard page, edit the key's permission to Full access, or create a new key with Full access for the non-sending work. Permission and domain restriction can be edited in the dashboard (the API only renames keys).
3. Check domain restriction: a Sending-access key can be restricted to one domain. If your from address uses a different domain than the restriction, sends fail too.
4. Check key status: a 403 "API key is not active" means the key was deactivated. Look at the API keys page and create a new key if needed. The key value is shown only once at creation, so store it then.
5. Verify: retry the failing call with the corrected key and confirm success. Keep separate keys per use (the dashboard shows last-used time per key) so one permission change cannot break other services.