type URI on every authentication_error problem body: https://docs.get-exo.com/errors/authentication_error.
HTTP status: 401 Unauthorized.
Why it happens
There is no anonymous surface. Every route resolves a principal before it does anything else, so a missing header, a malformed key, a revoked key and an expired key all land here. A credential that is valid but insufficient is not this code. That ispermission_denied with a 403.
How to fix it
- Send the key as
X-Exo-API-Key: exo_<env>_<token>, or asAuthorization: Bearer exo_<env>_<token>. Both are accepted and equivalent. - Check the key is still active with
GET /v1/keys. A revoked key authenticates as nothing. - If the credential is a dashboard session token rather than an API key, confirm it has not expired.
Related
permission_deniedservice_degraded- Errors for the envelope and the full catalogue