## TL;DR
PostHog has two key types: the project key authenticates capture; the personal key does not. Swap in the project key from the project settings and make sure the host matches your PostHog cloud or self-hosted instance.

```text
posthog 401 invalid project api key on capture
```

## Use this when
- POST to /capture returns 401.
- Events fire in dev but not production, or vice versa.
- The key in config does not start with the project prefix.

## Not for this skill when
- Events accepted but invisible, which is an ingestion or filter problem.
- 413 payload too large.
- CORS errors in browser SDKs.

## Steps
1. Confirm the 401 body says the project key is invalid. Verify: the message names the key, not the payload.
2. Open PostHog project settings and copy the project API key. Verify: it starts with the phc_ prefix.
3. Replace the key in every environment config and redeploy. Verify: a search shows no personal-key values in capture config.
4. Confirm the API host matches: the cloud host for cloud projects, your domain for self-hosted. Verify: the host resolves and serves the PostHog API.
5. Send one test event and check the live events feed. Verify: the event appears within seconds.

## Variant phrasings
### posthog capture 401 unauthorized
Common phrasing of the error.
### posthog invalid project api key
The key-angle search.
### posthog project key vs personal api key
The confusion-angle search.

Compatibility: PostHog capture API, cloud and self-hosted; key types unchanged across recent versions.

## Why it happens
The project key scopes capture to one project; the personal key is for the management API. Mixing them up is easy because both live in settings, and every capture call with the wrong one fails auth.

## Edge cases / pitfalls
- Rotating keys invalidates the old one everywhere; update all environments at once.
- EU cloud uses a different host than US cloud; the key alone is not enough.
- Reverse proxies can strip the key header; check proxy config if the key is right.
- Batch capture uses the same key rules; do not assume the batch endpoint is looser.
- The project key is designed to be embedded in client-side code; the personal key is the one to guard closely.
- Older self-hosted versions share the same key format; confirm the docs for the version you run.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_5jDf5HymLjRcH9kj3--wVg