> ## Documentation Index
> Fetch the complete documentation index at: https://docs.permitcore.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Invalid credentials

> 401 — the API key is malformed, revoked, or unknown. How to fix it.

Your request included an `Authorization: Bearer <key>` header, but the key
itself didn't resolve to an active credential — it's malformed, has been
revoked, or was never issued.

```json 401 application/problem+json theme={null}
{
  "type": "https://docs.permitcore.io/errors/invalid-credentials",
  "title": "Invalid Credentials",
  "status": 401,
  "detail": "Invalid or revoked API key.",
  "instance": "/v1/permits",
  "request_id": "req_815e1778d2b34558aa841a16db85bb13"
}
```

This is distinct from [`missing-credentials`](/errors/missing-credentials): the
header was present, so the problem is the key's **value**, not its absence.

## Fix it

<Steps>
  <Step title="Check the key you sent">
    Confirm you're sending the full plaintext key exactly as issued — no
    truncation, no extra whitespace, no leftover `<your-api-key>` placeholder.
    Keys are shown in full **only once**, at creation.
  </Step>

  <Step title="Rotate the key if it was revoked or lost">
    If the key was deleted, or you no longer have the plaintext, create a fresh
    one at
    [permitcore.io/account/api-keys](https://permitcore.io/account/api-keys)
    and update your environment. Revoked keys never reactivate.
  </Step>

  <Step title="Resubmit">
    ```bash theme={null}
    curl https://api.permitcore.io/v1/permits \
      -H "Authorization: Bearer $PERMITCORE_API_KEY"
    ```
  </Step>
</Steps>

## Common causes

* The key was revoked from the dashboard (any request with it now fails).
* Only part of the key was copied, or a placeholder was never replaced.
* A key from a different environment/account was used.
* Stray characters (newline, quotes) around the key in a config file or shell.

<Card title="Manage your keys" href="https://permitcore.io/account/api-keys" icon="key">
  Create, view usage for, and revoke keys from the developer console.
</Card>

See also [Authentication](/authentication) and the full [error catalog](/errors).
Every response carries an `x-request-id` header — include it in any support
request.