401 — Unauthorized — missing or invalid API key

No credential was presented, or the one presented did not resolve. Forge fails loudly here rather than silently downgrading to anonymous access.

Start free HTTP / REST → canonical

Diagnosis

When you hit this

A revoked or expired key still configured in a client.
The key sent as a bare header value rather than as Bearer <key>.
A key from a different environment.

Resolution

How to fix it

Use the Bearer prefix
Authorization: Bearer YOUR_FORGE_KEY. The bare key without the scheme is a 401.
Confirm the key is live
Rotate and re-issue from the dashboard if there is any doubt.
Omit the header entirely to test
Keyless normalization is allowed at a low daily cap, which is a quick way to prove the endpoint works and isolate the credential.

Normalization

What Forge does about it

Forge deliberately does not silently degrade. If a credential is presented and does not resolve, the request fails with 401 rather than being treated as anonymous — a silent downgrade would let a revoked key look like it was still working while quietly losing identity, history, and triggers.