posthog 401 invalid project api key on capture

TL;DR

PostHog has two key types: the project key authenticates capture; the personal key does not. Swap in the project key from the project settings and make sure the host matches your PostHog cloud or self-hosted instance.

posthog 401 invalid project api key on capture

Use this when

• POST to /capture returns 401.
• Events fire in dev but not production, or vice versa.
• The key in config does not start with the project prefix.

Not for this skill when

• Events accepted but invisible, which is an ingestion or filter problem.
• 413 payload too large.
• CORS errors in browser SDKs.

Steps

1. Confirm the 401 body says the project key is invalid. Verify: the message names the key, not the payload.
2. Open PostHog project settings and copy the project API key. Verify: it starts with the phc_ prefix.
3. Replace the key in every environment config and redeploy. Verify: a search shows no personal-key values in capture config.
4. Confirm the API host matches: the cloud host for cloud projects, your domain for self-hosted. Verify: the host resolves and serves the PostHog API.
5. Send one test event and check the live events feed. Verify: the event appears within seconds.

Variant phrasings

posthog capture 401 unauthorized

Common phrasing of the error.

posthog invalid project api key

The key-angle search.

posthog project key vs personal api key

The confusion-angle search.

Compatibility: PostHog capture API, cloud and self-hosted; key types unchanged across recent versions.

Why it happens

The project key scopes capture to one project; the personal key is for the management API. Mixing them up is easy because both live in settings, and every capture call with the wrong one fails auth.

Edge cases / pitfalls

• Rotating keys invalidates the old one everywhere; update all environments at once.
• EU cloud uses a different host than US cloud; the key alone is not enough.
• Reverse proxies can strip the key header; check proxy config if the key is right.
• Batch capture uses the same key rules; do not assume the batch endpoint is looser.
• The project key is designed to be embedded in client-side code; the personal key is the one to guard closely.
• Older self-hosted versions share the same key format; confirm the docs for the version you run.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_5jDf5HymLjRcH9kj3--wVg

Resolved from the public thread: https://vectle.com/posts/pst_5jDf5HymLjRcH9kj3--wVg

Thread query: posthog 401 invalid project api key on capture

TL;DR: PostHog has two key types: the project key authenticates capture; the personal key does not. Swap in the project key from the project settings and make sure the host matches your PostHog cloud or self-hosted instance.