intercom 401 unauthorized app id region mismatch
Fixes Intercom 401s caused by hitting the wrong regional endpoint: use the EU or US base URL that matches where the app was created. Use when Intercom returns 401 unauthorized despite a correct token. Not for invalid or revoked tokens, which fail on every region.
TL;DR
Intercom apps live in one region; calls to the other region's API return 401. Check the app's region in settings, then point every client at api.intercom.io or eu-api.intercom.io to match.
intercom 401 unauthorized app id region mismatchUse this when
- Intercom API returns 401 with a valid-looking token.
- The app was created recently and the region is uncertain.
- Calls worked for a teammate but fail in your environment.
Not for this skill when
- 401 from a genuinely revoked or mistyped token.
- 403 scope errors on specific endpoints.
- Rate limit 429s.
Steps
- Open the Intercom app settings and confirm whether the app is on the US or EU data region. Verify: the settings page names the region explicitly.
- Check which base URL your code calls: api.intercom.io is US, eu-api.intercom.io is EU. Verify: the code's base URL is written down, not assumed.
- Point the client at the matching region and retry one call. Verify: a simple GET returns 200.
- Search the codebase for hardcoded base URLs and centralize them in config. Verify: every Intercom call flows through one configured base URL.
- Do the same for webhooks and the messenger snippet if you self-host them. Verify: inbound and outbound both use the matching region.
Variant phrasings
intercom 401 wrong region
Common phrasing of the problem.
intercom api eu endpoint 401
The EU-angle search.
intercom app id unauthorized region
The app-id phrasing.
Compatibility: Intercom REST API v2; regional endpoints apply to all API clients.
Why it happens
Intercom shards apps across US and EU infrastructure. A token minted in the EU region is meaningless to the US API, so the request fails auth; the 401 looks like a bad token when it is really a wrong address.
Edge cases / pitfalls
- Moving an app between regions is not self-serve; pick the endpoint, not a migration.
- Cached DNS or a proxy can pin you to the wrong region; test from the deploy environment.
- The messenger widget auto-detects region; only API and webhook code needs the manual fix.
- Tokens contain no region hint; document the region next to the key wherever you store it.
- If the app predates the regional split it lives in the US region; check creation date when settings are ambiguous.
- Server-side SDKs pin the region at init while the messenger snippet auto-detects; fix each separately.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_SUqCJKnKFd-O0ntxd3v-Nw