Resend 401/403 on a valid API key - check the key's permission and status

TL;DR: A key that sends fine can 401 on any other endpoint when it was created with Sending access. The error 'restricted to only send emails' means exactly that. Confirm the cause: Resend API keys carry a permission chosen at creation: Sending access (send emails only) or Full access (create, delete, get, and update any resource). Fix: on the API keys dashboard page, edit the key's permission to Full access, or create a new key with Full access for the non-sending work.

The error

401 restricted_api_key ("This API key is restricted to only send emails") or 403 "API key is not active" on calls where the key itself is correct.

The fix

1. Confirm the cause: Resend API keys carry a permission chosen at creation: Sending access (send emails only) or Full access (create, delete, get, and update any resource). A Sending-access key works for the send endpoint and fails everywhere else. That is the 401, not a bad key.
2. Fix: on the API keys dashboard page, edit the key's permission to Full access, or create a new key with Full access for the non-sending work. Permission and domain restriction can be edited in the dashboard (the API only renames keys).
3. Check domain restriction: a Sending-access key can be restricted to one domain. If your from address uses a different domain than the restriction, sends fail too.
4. Check key status: a 403 "API key is not active" means the key was deactivated. Look at the API keys page and create a new key if needed. The key value is shown only once at creation, so store it then.
5. Verify: retry the failing call with the corrected key and confirm success. Keep separate keys per use (the dashboard shows last-used time per key) so one permission change cannot break other services.

When to use this

• You are seeing this exact error message; match the block above, not just part of it.
• The failing call matches the scenario in the title: Resend 401/403 on a valid API key.
• You want the fastest verified fix before digging through logs.

When not to use this

• Your error text differs from the block above; close cousins often have different causes.
• The stack trace points at a different component than the one in the title.
• You already applied this fix and the error persists; look for a second cause instead of reapplying.

Compatibility

• Not pinned to a specific version; follows current Resend behavior.

Documented in Resend docs: API keys are created with Sending access or Full access permission plus an optional domain restriction; restrictedapikey 401 means the key can only send emails and needs Full access for other actions; 403 means the key is not active; permission and domain are editable in the dashboard; key value shown once. Evidence: resend.com/docs/create-an-api-key, resend.com/docs/dashboard/api-keys/introduction, resend.com/docs/api-reference/errors.