OpenAI 401 Invalid Authentication: revoked key, wrong org, or missing permission

TL;DR: This 401 variant is not about typos. It means the credential itself is rejected: revoked, assigned to a different org or project, or lacking permission for the endpoint. Confirm the cause Three documented causes: 1. Check the API keys page: does the key still exist and is it active?

The error

text
401 Invalid Authentication

The fix

TL;DR: This 401 variant is not about typos. It means the credential itself is rejected: revoked, assigned to a different org or project, or lacking permission for the endpoint. Confirm the cause Three documented causes: 1. Check the API keys page: does the key still exist and is it active?

The error

401 Invalid Authentication

The symptom

401 Invalid Authentication, distinct from Incorrect API key provided. The key may be well-formed and typo-free. The API is refusing the credential, not the spelling.

Confirm the cause

Three documented causes:

1. Revoked key. You are using a key that was revoked. Check the API keys page: does the key still exist and is it active? Revocation is immediate and silent on the client side.
2. Key assigned to a different org or project. You are using a different key than the one assigned to the requesting organization or project. This bites when code sets OPENAI_ORG_ID or OPENAI_PROJECT_ID (or the equivalent headers) pointing at an org or project the key does not belong to. The key is valid; the pairing is not.
3. Missing permission for the endpoint. The key does not have the required permissions for the endpoint you are calling. Management endpoints (organization, usage, project admin) need admin keys; a standard project key is rejected there even though it works for inference.

The fix

• Revoked: generate a new key and replace it everywhere (see the rotation skill for the layer hunt).
• Wrong org or project: unset the org/project env vars unless you deliberately need scope selection, or mint the key under the org and project the code targets. Project-related keys live under that project's General settings in the dashboard.
• Permissions: use an admin key for management endpoints, and keep admin keys out of application code. Application code gets project-scoped keys with the minimum it needs.

Verify the fix

Call GET /v1/models with the key from the failing environment and confirm 200, then call the previously failing endpoint. If models works and the endpoint still 401s, it is cause 3. If both fail, it is cause 1 or 2.

When to use this

• You are seeing this exact error message; match the block above, not just part of it.
• The failing call matches the scenario in the title: OpenAI 401 Invalid Authentication.
• You want the fastest verified fix before digging through logs.

When not to use this

• Your error text differs from the block above; close cousins often have different causes.
• The stack trace points at a different component than the one in the title.
• You already applied this fix and the error persists; look for a second cause instead of reapplying.

Compatibility

• Not pinned to a specific version; follows current OpenAI behavior.