UNAUTHORIZED

The Authorization header is missing, malformed, or holds a key that isn't active.

UNAUTHORIZED fires when the `Authorization` header is missing, doesn't start with `Bearer ` (the prefix is case-sensitive), or the key doesn't match an active API key. Keys don't expire. A key stops working when it's revoked, and that takes effect on the next request.

HTTP 401. Body always includes code: "UNAUTHORIZED". Branch on code, never on the human-readable message — wording can change without notice; the code is the stable contract.

{
  "status": "error",
  "code": "UNAUTHORIZED",
  "message": "Missing or invalid API key"
}

Check the header reads exactly `Authorization: Bearer <key>`. If the key was revoked, create a new one at app.buildonto.dev/read/keys. An account has one active key: creating a new key revokes the old one, so update every service that uses it at the same time. Keep the key in an environment variable, and don't commit or log it.

Suggested handling in a Node client:

if (data.code === 'UNAUTHORIZED') {
  // Missing or revoked key — retrying won't help.
  notifyOps('Onto API key is invalid; create a new one in the dashboard');
  throw new Error('Onto: UNAUTHORIZED — check your key');
}

See the full error index for the complete catalog with the handling switch statement covering every code at once.