Fix API authentication errors

Before you start

• The key you are using and the response body. Look at code and message.

Fix common problems

401, "API key is missing, revoked, expired, or not valid for this tenant". Check each one in turn.

1. Confirm the header reads Authorization: Bearer <key> with no extra characters.
2. Check the key is not marked revoked. Account keys are at /settings/api-keys. Workspace keys are under Settings, then API keys.
3. Check the expiry date if you set one when you created the key.
4. Check the workspace header, if you send one. It must name the workspace the key belongs to.

Any bearer value counts as a key attempt. A bad key never falls back to your browser session.

403, "API key lacks the suite:read scope" or "suite:write scope". The key is missing a scope. Make a new key with the scope the route needs.

403, "API key creator is not a tenant owner". The route needs an owner. Make the key while signed in as the workspace owner.

A workspace key fails on account routes. This is by design. Use an account key for profile, email, billing and domains.

400, "You belong to more than one tenant". You called with a session and no workspace. Send the workspace id or slug in the x-yaya-tenant header.

Lost the key. yaya shows a key once. Revoke it and create a new one.

Still stuck

Email support@yaya.page with the request_id from the error body. Never send the key itself.