Claude authentication_error 401 — Fix Invalid API Key (2026) | AI Error Hub

Anthropic Claude Authentication Severity: Critical HTTP 401

Claude `authentication_error` — 401 Invalid API Key

Your API key is missing, malformed, or revoked. This is a critical error that blocks all API access — no request will succeed until it's fixed. Four common causes below with exact fixes.

Error code: authentication_error HTTP: 401 Category: Authentication Last tested: Nov 14, 2026

Quick Fix (TL;DR)

Check your API key exists and is passed correctly. Set `ANTHROPIC_API_KEY` in your environment (starts with `sk-ant-`). If you're passing it manually, use the `x-api-key` header — NOT `Authorization: Bearer` (that's OpenAI).

Verify at console.anthropic.com/settings/keys that your key still exists and hasn't been revoked.

The Error Message You're Seeing

Response body

HTTP/1.1 401 Unauthorized
content-type: application/json

{
  "type": "error",
  "error": {
    "type": "authentication_error",
    "message": "invalid x-api-key"
  }
}

Common message variants: "missing x-api-key header", "invalid x-api-key", "invalid API key format". All indicate the same category of issue — your credentials aren't reaching Claude correctly.

What Actually Causes This Error

45%

Environment variable not loadedThe ANTHROPIC_API_KEY env var isn't set, or isn't visible to the process running your code (common with dotenv, systemd, Docker).

28%

Wrong header format (Authorization vs x-api-key)Copying OpenAI-style code, using Authorization: Bearer. Anthropic requires x-api-key.

14%

Key revoked or deletedYou (or someone on your team) revoked the key. Common after security incidents or teammate departures.

Wrong workspace/organization keyYou have multiple Anthropic organizations and used the wrong key. Keys are org-scoped.

Key format corruption (whitespace, quotes)Copy-paste added a newline or the shell interpreted special characters. Common with the = character in .env files.

Fixes That Work (Tested Nov 2026)

1Verify Environment Variable Is Set Correctly

Bash · verification
# Check if the variable is set (should print your key)
echo "$ANTHROPIC_API_KEY"

# Check that it starts with sk-ant-
if [[ "$ANTHROPIC_API_KEY" == sk-ant-* ]]; then
    echo "✓ Key format looks correct"
else
    echo "✗ Key missing or wrong format"
fi

# Set it for current shell (temporary)
export ANTHROPIC_API_KEY="sk-ant-api03-YOUR-KEY-HERE"

# Set it permanently (add to ~/.bashrc or ~/.zshrc)
echo 'export ANTHROPIC_API_KEY="sk-ant-api03-..."' >> ~/.zshrc
source ~/.zshrc

Python · dotenv setup
# pip install python-dotenv anthropic
import os
from dotenv import load_dotenv
import anthropic

# Load .env BEFORE importing client
load_dotenv()

# Verify key is loaded
key = os.environ.get("ANTHROPIC_API_KEY")
if not key:
    raise ValueError("ANTHROPIC_API_KEY not set")
if not key.startswith("sk-ant-"):
    raise ValueError("Key format invalid — should start with sk-ant-")

client = anthropic.Anthropic()  # auto-reads env var

2Use Correct Header Format (x-api-key, Not Bearer)

If you're calling the API directly with curl or a raw HTTP client, this is the #1 mistake. Anthropic uses x-api-key, not Authorization: Bearer.

curl · correct header
# ✓ CORRECT — x-api-key header
curl https://api.anthropic.com/v1/messages \
    -H "x-api-key: $ANTHROPIC_API_KEY" \
    -H "anthropic-version: 2023-06-01" \
    -H "content-type: application/json" \
    -d '{
        "model": "claude-sonnet-4-5",
        "max_tokens": 1024,
        "messages": [{"role": "user", "content": "Hello"}]
    }'

# ✗ WRONG — this is OpenAI-style, doesn't work for Anthropic
# curl -H "Authorization: Bearer $ANTHROPIC_API_KEY" ...

Don't forget anthropic-version

Every Anthropic request also requires an anthropic-version header. Missing this triggers a different 400 error but is worth setting alongside your auth.

3Rotate Key If Revoked or Compromised

If your key was revoked (accidentally, after a security incident, or by a teammate), you need to create a new one:

Go to console.anthropic.com/settings/keys
Click "Create Key" and name it (e.g., "prod-2026", "staging-dev")
Copy the key IMMEDIATELY — you can't see it again after this screen
Update your environment variables, secrets manager, or .env file
Restart your application to pick up the new key
Delete the old key once the new one is working

Security best practice

Never commit API keys to git. Use environment variables, AWS Secrets Manager, GCP Secret Manager, or Vercel/Netlify environment settings. Rotate keys quarterly.

Preventing This Error Going Forward

Validate on startup. Check that your API key is loaded before your app starts serving requests.
Use different keys per environment. Prod, staging, and dev should have separate keys with clear naming.
Store keys in a secrets manager. Not .env files in production — use AWS Secrets Manager, Vault, or your cloud provider's equivalent.
Monitor for 401 spikes. A sudden burst of 401s often signals credential rotation or a deploy issue.
Document your keys. Keep a registry of which key is used where, so revocations don't cause surprises.

Tested by Sana K.
Researcher · AI Error Hub

Last verified: Nov 14, 2026 · SDK: anthropic-sdk-python 0.42

Frequently Asked Questions

No. Bedrock uses AWS IAM credentials (access key + secret key). Vertex uses Google Cloud service accounts. Only the direct Anthropic API uses x-api-key with sk-ant- keys. Cross-cloud fallback code needs separate credential handling.

Technically yes, but you shouldn't. Rate limits apply per-organization, not per-key. Staging traffic will consume production quota. Create separate keys per environment for clear billing attribution and independent rotation.

Anthropic uses prefixes to identify key types: sk-ant-api03- is a standard API key, sk-ant-admin- is an admin/organization key. If your key doesn't start with sk-ant-, it's malformed or you copied the wrong string.

99% of the time it's environment variable loading. Check that: (1) your production runtime has the env var set, (2) your deploy platform (Vercel, Railway, Heroku) has the secret configured, (3) you're not using a .env file that isn't included in the production build.

You can validate format (starts with sk-ant-, correct length) but you can't verify the key is active without making an API call. A common pattern is to make one cheap "warmup" call on app startup — if it fails 401, fail loud immediately.

Claude authentication_error — 401 Invalid API Key

Check your API key exists and is passed correctly. Set ANTHROPIC_API_KEY in your environment (starts with sk-ant-). If you're passing it manually, use the x-api-key header — NOT Authorization: Bearer (that's OpenAI).