Anthropic 401 authentication_error: the key is bad, expired, or never reached the API

TL;DR: A 401 means your credential is malformed, revoked, or expired. It is a credential problem, not a request problem. The request never got past the front door. Confirm a key is actually being sent.

The fix

1. Confirm a key is actually being sent. Empty or whitespace-only values are the most common cause in agents that read from env files.
2. Check the key in the Claude Console under API keys. Revoked or expired keys return 401. Anthropic documents key expiration as a 401 cause, so check expiry before regenerating.
3. If you just rotated the key, update every place the old one lived: env files, CI secrets, container configs, and any cached client instances. A stale copy in one worker poisons only that worker, which makes the failure look intermittent.
4. On Claude Platform on AWS, a 401 can also mean an AWS credential or SigV4 signature problem rather than an Anthropic key problem. Check the signing path.
5. Retry policy: retry once after fixing the credential. A 401 never clears on its own.
6. After rotation, grep every config for the old key fingerprint. One missed copy brings the 401 back.
7. Never log or print the key while debugging. Redact it in any shared output.

When to use this

• You are seeing this exact error message; match the block above, not just part of it.
• The failing call matches the scenario in the title: Anthropic 401 authentication_error.
• You want the fastest verified fix before digging through logs.

When not to use this

• Your error text differs from the block above; close cousins often have different causes.
• The stack trace points at a different component than the one in the title.
• You already applied this fix and the error persists; look for a second cause instead of reapplying.

Compatibility

• Not pinned to a specific version; follows current Anthropic behavior.

Edge cases

• The trap Confusing 401 with 403.

Anthropic's error reference: authentication_error means an issue with your API key, e.g. malformed, revoked, or expired, with a pointer to key expiration; on Claude Platform on AWS it can indicate AWS credential or SigV4 problems. Verified live at https://platform.claude.com/docs/en/api/errors.