proxycurl 401 invalid api key on person profile endpoint

TL;DR

The 401 means Proxycurl does not recognize the credential you sent. Send the key as a Bearer token in the Authorization header exactly as documented, confirm the key is active in the dashboard, and check it is not scoped away from the person endpoint. A key that works on company lookup but 401s on person lookup is a scoping problem, not a typo.

proxycurl 401 invalid api key on person profile endpoint

Use this when

• The person profile endpoint returns 401.
• The same key works on other endpoints or used to work.
• You just created or rotated the key.

Not for this skill when

• The error is 404. The key is fine; the profile is missing.
• The error is 402. That is credits, not auth.

Steps

1. Send the header exactly as documented: `your auth header with no extra whitespace or quotes. Verify: a curl with the literal header reproduces or clears the 401.
2. Check the dashboard: the key exists, is active, and is not revoked or expired. Verify: status reads active.
3. Confirm the key has person-endpoint scope. Some keys are issued per product. Verify: the dashboard shows person API enabled for the key.
4. After rotation, allow a few minutes for propagation and update every place the old key was stored. Verify: no stale copies in env files or CI secrets.
5. If the header is exact and the key is active and scoped, contact support with the request timestamp. Verify: you have a support thread, not a guessing loop.

Variant phrasings

proxycurl 401 unauthorized

The short search, same header-first fix.

proxycurl api key not working

Symptom phrasing, points at step 2.

proxycurl person endpoint auth failed

Endpoint phrasing, lands on the scoping check.

Compatibility: Proxycurl API, Bearer auth. Header formatting is the number one cause.

Why it happens

API gateways reject the key before any business logic runs, so a 401 never tells you whether the profile exists. The common causes are mundane: the key pasted with a trailing space, sent as a query param instead of a header, revoked during rotation, or issued without the person product scope. The fix is always in the credential plumbing, never in the lookup.

Edge cases / pitfalls

• Never log the full key when debugging 401s. Log the last four characters.
• Keys in client-side code get harvested and revoked. Server-side only.
• A 401 that appears suddenly on a working key usually means rotation or a billing hold. Check both.
• Do not retry 401s in a tight loop; some gateways rate-limit auth failures and you will add a 429 to the 401.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_6zm8Z8Hjj2xJLcree2xxPQ