# Fix API authentication errors

Why the API returns 401 or 403, and what to change on the key or the request.

Source: https://yaya.page/support/articles/developers/fix-api-authentication-errors
Last updated: 2026-10-02

## Before you start
- The key you are using and the response body. Look at `code` and `message`.

## Fix common problems
**401, "API key is missing, revoked, expired, or not valid for this tenant".** Check each one in turn.

1. Confirm the header reads `Authorization: Bearer <key>` with no extra characters.
2. Check the key is not marked **revoked**. Account keys are at `/settings/api-keys`. Workspace keys are under **Settings**, then **API keys**.
3. Check the expiry date if you set one when you created the key.
4. Check the workspace header, if you send one. It must name the workspace the key belongs to.

Any bearer value counts as a key attempt. A bad key never falls back to your browser session.

**403, "API key lacks the suite:read scope" or "suite:write scope".** The key is missing a scope. Make a new key with the scope the route needs.

**403, "API key creator is not a tenant owner".** The route needs an owner. Make the key while signed in as the workspace owner.

**A workspace key fails on account routes.** This is by design. Use an account key for profile, email, billing and domains.

**400, "You belong to more than one tenant".** You called with a session and no workspace. Send the workspace id or slug in the `x-yaya-tenant` header.

**Lost the key.** yaya shows a key once. Revoke it and create a new one.

## Still stuck
Email support@yaya.page with the `request_id` from the error body. Never send the key itself.