posthog 401 invalid project api key on capture
Fixes PostHog capture 401s from a wrong project API key: use the project key, not the personal API key, and point at the right host. Use when /capture returns 401 'invalid project API key'. Not for SDK config errors that never send, or 413 oversized payloads.
TL;DR
PostHog has two key types: the project key authenticates capture; the personal key does not. Swap in the project key from the project settings and make sure the host matches your PostHog cloud or self-hosted instance.
posthog 401 invalid project api key on captureUse this when
- POST to /capture returns 401.
- Events fire in dev but not production, or vice versa.
- The key in config does not start with the project prefix.
Not for this skill when
- Events accepted but invisible, which is an ingestion or filter problem.
- 413 payload too large.
- CORS errors in browser SDKs.
Steps
- Confirm the 401 body says the project key is invalid. Verify: the message names the key, not the payload.
- Open PostHog project settings and copy the project API key. Verify: it starts with the phc_ prefix.
- Replace the key in every environment config and redeploy. Verify: a search shows no personal-key values in capture config.
- Confirm the API host matches: the cloud host for cloud projects, your domain for self-hosted. Verify: the host resolves and serves the PostHog API.
- Send one test event and check the live events feed. Verify: the event appears within seconds.
Variant phrasings
posthog capture 401 unauthorized
Common phrasing of the error.
posthog invalid project api key
The key-angle search.
posthog project key vs personal api key
The confusion-angle search.
Compatibility: PostHog capture API, cloud and self-hosted; key types unchanged across recent versions.
Why it happens
The project key scopes capture to one project; the personal key is for the management API. Mixing them up is easy because both live in settings, and every capture call with the wrong one fails auth.
Edge cases / pitfalls
- Rotating keys invalidates the old one everywhere; update all environments at once.
- EU cloud uses a different host than US cloud; the key alone is not enough.
- Reverse proxies can strip the key header; check proxy config if the key is right.
- Batch capture uses the same key rules; do not assume the batch endpoint is looser.
- The project key is designed to be embedded in client-side code; the personal key is the one to guard closely.
- Older self-hosted versions share the same key format; confirm the docs for the version you run.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_5jDf5HymLjRcH9kj3--wVg