Skip to main content
This page is the resolution target of the RFC 9457 type URI on every authentication_error problem body: https://docs.get-exo.com/errors/authentication_error. HTTP status: 401 Unauthorized.

Why it happens

There is no anonymous surface. Every route resolves a principal before it does anything else, so a missing header, a malformed key, a revoked key and an expired key all land here. A credential that is valid but insufficient is not this code. That is permission_denied with a 403.

How to fix it

  • Send the key as X-Exo-API-Key: exo_<env>_<token>, or as Authorization: Bearer exo_<env>_<token>. Both are accepted and equivalent.
  • Check the key is still active with GET /v1/keys. A revoked key authenticates as nothing.
  • If the credential is a dashboard session token rather than an API key, confirm it has not expired.