## TL;DR

The Application ID and API key pair does not match, or the key was revoked. Copy both fresh from the Algolia dashboard, making sure the ID and the key come from the same application, update the client, and requests authenticate. Never mix a key from one app with another app's ID.

The ID and the key are a pair. They must come from the same place.

## Verbatim query

```text
algolia API error: Invalid Application-ID or API key
```

## Steps

1. Open the Algolia dashboard API keys page
   Select the application the integration is supposed to use.
   Expected: You are looking at the keys for the correct application.

2. Copy the Application ID and a valid API key from the same app
   Take both values together from the same screen. Use a key with the permissions the integration needs.
   Expected: An ID and key pair from one application.

3. Update the client configuration
   Replace both values wherever the generated client stores them, even if you think only one changed.
   Expected: The client sends the fresh pair on the next request.

4. Run a test search
   Send a simple search request to confirm authentication works.
   Expected: A 200 response with search results.

5. Label credentials per application in the generated client
   Store the app name alongside the ID and key so the next person cannot mix pairs across apps.
   Expected: Each credential set is tagged with its application.

## Use this when

- Algolia rejects requests with "Invalid Application-ID or API Key."
- A generated client was configured by copying values from different dashboard screens.
- The same key works in one app's context and fails in another's.

## Not for this skill when

- The error is a 403 about insufficient permissions, meaning the key is valid but lacks the right ACL.
- The problem is an index-not-found error.
- The failure is an Algolia rate limit.

## Variant phrasings

### "Invalid Application-ID or API Key" on indexing operations

Writes fail the same way as reads with a mismatched pair. Same fix.

### 403 invalid credentials wording on Algolia

Check whether it is truly a bad pair or a valid key with the wrong ACL; the fixes differ.

## Why it happens

Algolia API keys are scoped to a single application, and the dashboard's app switcher makes it easy to copy an Application ID from one app and a key from another. Generated clients also tend to accumulate credentials across environments until nobody knows which pair belongs to which app. The API sees a mismatched pair and rejects it flatly.

## Edge cases

- Admin keys, search-only keys, and restricted keys have different powers; a valid pair with the wrong key type still fails the operation.
- Keys copied with leading or trailing whitespace fail; trim on paste.
- The dashboard app switcher is the classic mixing point; always re-check which app is selected.
- Restricted keys with referer or IP limits fail from unexpected origins even though the pair is valid.
- Rotating a key in the dashboard instantly kills the old one; update every client that used it.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_DsnkCpbcPdPVosYNBJIktw