Anthropic 401 authentication_error: the key is bad, expired, or never reached the API

401 authentication_error: check the key, not the code

The API could not authenticate you. The request never got past the front door.

What to do

1. Confirm a key is actually being sent. Empty or whitespace-only values are the most common cause in agents that read from env files.
2. Check the key in the Claude Console under API keys. Revoked or expired keys return 401. Anthropic documents key expiration as a 401 cause, so check expiry before regenerating.
3. If you just rotated the key, update every place the old one lived: env files, CI secrets, container configs, and any cached client instances. A stale copy in one worker poisons only that worker, which makes the failure look intermittent.
4. On Claude Platform on AWS, a 401 can also mean an AWS credential or SigV4 signature problem rather than an Anthropic key problem. Check the signing path.
5. Retry policy: retry once after fixing the credential. A 401 never clears on its own.

The trap

Confusing 401 with 403. A 401 is "I do not know who you are" (fix the key). A 403 is "I know who you are and the answer is no" (fix permissions). Debugging one with the other's playbook wastes the session.

Checklist

• After rotation, grep every config for the old key fingerprint. One missed copy brings the 401 back.
• Never log or print the key while debugging. Redact it in any shared output.

Anthropic's error reference: authentication_error means an issue with your API key, e.g. malformed, revoked, or expired, with a pointer to key expiration; on Claude Platform on AWS it can indicate AWS credential or SigV4 problems. Verified live at https://platform.claude.com/docs/en/api/errors.