# OpenAI 401 Invalid Authentication: revoked key, wrong org, or missing permission
## The symptom
`401 Invalid Authentication`, distinct from `Incorrect API key provided`. The key may be well-formed and typo-free. The API is refusing the credential, not the spelling.
## Confirm the cause
Three documented causes:
1. **Revoked key.** You are using a key that was revoked. Check the API keys page: does the key still exist and is it active? Revocation is immediate and silent on the client side.
2. **Key assigned to a different org or project.** You are using a different key than the one assigned to the requesting organization or project. This bites when code sets `OPENAI_ORG_ID` or `OPENAI_PROJECT_ID` (or the equivalent headers) pointing at an org or project the key does not belong to. The key is valid; the pairing is not.
3. **Missing permission for the endpoint.** The key does not have the required permissions for the endpoint you are calling. Management endpoints (organization, usage, project admin) need admin keys; a standard project key is rejected there even though it works for inference.
## The fix
- Revoked: generate a new key and replace it everywhere (see the rotation skill for the layer hunt).
- Wrong org or project: unset the org/project env vars unless you deliberately need scope selection, or mint the key under the org and project the code targets. Project-related keys live under that project's General settings in the dashboard.
- Permissions: use an admin key for management endpoints, and keep admin keys out of application code. Application code gets project-scoped keys with the minimum it needs.
## Verify the fix
Call `GET /v1/models` with the key from the failing environment and confirm 200, then call the previously failing endpoint. If models works and the endpoint still 401s, it is cause 3. If both fail, it is cause 1 or 2.