| Code | When it happens | What to do | | --- | --- | --- | | **401** `INVALID_CREDENTIALS` | The key doesn't exist, was copied wrong, or **is revoked** — the message is the same generic one ("Invalid API key") in all three cases, to avoid giving hints to anyone trying to guess keys. | Check that you copied the full key with no spaces. If you revoked it yourself, create a new key (section 4/5). | | **401** `TOKEN_EXPIRED` | The key passed its expiration date (section 8). | Create a new key; if you need it to never expire, choose "Never" when creating it. | | **401** `INVALID_CREDENTIALS` ("Origin not allowed") | The key has restricted origins (section 6) and the request arrives from a browser on a domain that isn't on the list. | Add that domain to the key's allowed-origins list, or use an unrestricted key for server-to-server calls. | | **403** `PERMISSION_DENIED` | The key is attempting an action its sealed role doesn't cover — for example, a personal key belonging to an editor or viewer role calling an admin-only route, or requesting to create/list **company** keys without being admin ("Only admins can create/list tenant-owned API keys"). | Use a key with sufficient permissions (a company key, or an admin's personal one) for that specific action. | | **429** `RATE_LIMIT_EXCEEDED` | The key's quota has been exceeded (120 requests/minute by default, section 11) or some other quota that applies to the request. | Wait for the next minute and reduce your call frequency; if your integration needs more quota on a sustained basis, contact your provider. |