invalid_credentials

What it means

The Platform API rejected the request with HTTP status 401 and the error code invalid_credentials. The meaning is narrow: the API key is not valid. Other parts of the request are not the issue here, so a correct endpoint and body still return this code when the key itself fails.

Errors arrive in one shape: error.code, error.message and error.hint inside a top-level error object. A typical message is "That API key is not valid." The code is the stable part, so match on invalid_credentials and never on the message text. missing_credentials and key_expired are related codes you may see in similar situations.

Why you are seeing it

Keys are validated in a fixed order: shape, existence, hash, expiry, revocation, client status, plan. invalid_credentials covers the first three checks, so the key either has the wrong shape, does not exist, or carries a secret that does not match the stored SHA-256 hash.

Wrong shape is the usual culprit. Keys start with the olvp_ prefix and must be sent exactly as issued. A value that was edited, wrapped across lines, stripped of its prefix, or pasted with a trailing space fails before the platform looks it up.

The hash check covers the rest. If the key exists but its secret does not hash to the stored SHA-256 value, validation stops there. That happens when an environment variable holds a different key than you expect, or when a rotated key is still deployed somewhere.

How to fix it

Copy the whole key, including the olvp_ prefix, and send it unchanged. The key is shown once when it is created, so there is no later way to read it back. If you did not save the full string, treat the key as lost.

Create a new key and revoke the old one. Then update every place the old value lives, including environment variables, secret managers, CI settings and local .env files, and redeploy so nothing still sends the revoked key. Keep keys out of source control and out of shared logs.

To find the bad value, log a fingerprint such as the last few characters and the environment it came from. Never print the full secret.

Handling it in code

Treat invalid_credentials as a configuration failure, not a transient one. Retrying with the same key returns the same 401, so break the retry loop and report the failure instead.

Parse the response body, read error.code, and branch on invalid_credentials. Keep a default branch for codes you do not handle yet, so an unfamiliar error does not crash the parser. One parser covers every error because the shape is always error.code, error.message and error.hint.

Send the failure somewhere a person will see it: an alert, a failing health check, or a message in your admin tooling. A 401 that only reaches a debug log can leave an integration broken and silent.