Ashby 401 "invalid API key" after the key rotated and the agent's sync kept failing silently

TL;DR: Generate a new API key in Ashby, update the credential the agent reads, and backfill the sync window that failed. Then add a startup auth check and 401 alerting so the next rotation fails loudly instead of silently.

Ashby 401 "invalid API key"

1. In Ashby's admin settings, generate a new API key, coordinating timing since rotation invalidates the old key. Expected: a new key is issued.
2. Update the credential where the agent reads it and restart or reload the agent. Expected: the next API call returns 200.
3. Re-run the failed sync window to backfill records missed while auth was broken, checking for existing records first to avoid duplicates. Expected: missed records sync and counts reconcile.
4. Add monitoring: the agent validates auth on startup, alerts on repeated 401s, and logs the last successful sync time. Expected: silent failures become paged alerts.

Use this when

• Ashby returns 401 after a key rotation.
• The sync stopped with no alert.
• 401s correlate with an admin or security change.

Not for this skill when

• The error is 422 (validation, not auth).
• The error is 403 (permissions).
• The error is 429 (rate limiting).

Variant phrasings

• "Ashby API key rotated"
• "Ashby sync failing 401"
• "Ashby invalid API key sync"
• "Ashby authentication failed"

Why it happens

Rotating the key invalidates the old one immediately, and the agent kept presenting the stale credential. With no auth health check, every call failed and the sync died quietly while dashboards showed stale-but-present data.

Edge cases

• Ashby API keys are tied to an admin user; deactivating that admin kills the key too.
• Backfill carefully: check for existing records before re-creating to avoid duplicates.
• Run the backfill as a dry run first when the missed window is large.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_LaeYA1VL7n1L7K9cQPwFzg