Error explained

401 Unauthorized from an API

401 Unauthorized

The API did not accept your credentials: the key was missing, wrong, or no longer valid.

What it means

A 401 means the request did not carry valid credentials. For an AI API that means the key: it was not sent, it is wrong, or it is no longer valid. It is not the same as 403, where the server knows who you are but will not let you do that.

Anthropic's API calls it authentication_error and ties it to a key that is malformed, revoked or expired. OpenAI's version reads "Incorrect API key provided".

Common causes

The key is not reaching the request. The environment variable name is misspelled, it is not set where the code runs, or the code runs in the browser. In Next.js, only variables starting with NEXT_PUBLIC_ reach the browser, and their values are written into the code at build time. A secret key must never be one of them: anyone who opens your site could read it. Call the API from the server instead.
The key itself is wrong. OpenAI's error guide lists a typo or extra space, a key from a different organization or project, and a key that was deleted.
You changed the variable on Vercel and did not redeploy. Vercel applies environment variable changes to new deployments only.

A prompt to fix it

Paste it into your AI coding tool and fill in the parts in angle brackets. It asks the tool to find the cause and show you before it changes anything.

Paste it, then fill in the <angle brackets>

My app gets 401 Unauthorized from <the API, for example OpenAI or Anthropic>.
The error body says: <paste it, but not the key itself>

Do not print, log or paste my API key anywhere, including in your answer.

Check each of these and tell me what you find:
1. Which environment variable the code reads the key from, and whether that exact name is set where the code runs: locally (.env.local) and in the Vercel project settings.
2. Whether the call happens on the server. If the key is used in browser code or in a NEXT_PUBLIC_ variable, move the call to a server route and keep the key on the server.
3. Whether the value could have a stray space, quote or line break around it.
4. Whether the key belongs to the account or project the request is for.

Then fix only what is wrong. If the key itself is bad, tell me to create a new one in the provider's dashboard. Do not invent one.

How to check it is fixed

The same request now succeeds.
Your key is not in anything the browser downloads: search your site's JavaScript files in the browser's developer tools for the first few characters of the key.
If you changed a variable on Vercel, make sure the deployment you are testing was created after the change.

Tested prompts that help

Hand It An Error — If the fix above does not do it, or your error is close to this one but not quite, this prompt hands your AI tool the whole error, what you expected, the last thing you changed and what you already ruled out, and makes it name the cause before it changes anything. Test log: Pass, ChatGPT (Pro), September 27, 2026; Pass, Claude.ai (Fable 5.1 Max), September 27, 2026.

Sources

Everything above comes from these pages. We read them on September 27, 2026; if one has changed since, it wins.