Problems with API keys
The API responds with 401 or 429, a key is lost or was shared by mistake.
You create API keys under API Key. A key has the form bhomy_live_sk_ followed by 48 characters and is sent in the Authorization: Bearer … header.
The API responds with 401
code in the response | Meaning | Solution |
|---|---|---|
auth.missing_header | The Authorization header is missing | Send the header with every request |
auth.invalid_type | The header doesn't start with Bearer | Write Authorization: Bearer bhomy_live_sk_… with a space after Bearer |
auth.invalid_key | The key doesn't exist or is incomplete | Check that it was copied in full, without a space or line break at the end |
auth.key_revoked | The key is deactivated | Reactivate it under API Key with Reactivate or use another one |
The API responds with 429
error in the response | Meaning | Solution |
|---|---|---|
rate_limit_exceeded | More than 60 requests in 60 seconds, per key and per IP address. limit_scope tells you which limit applied | Wait for the number of seconds given in the Retry-After header and spread out your requests |
concurrent_limit_reached | All lines in your plan are busy | Wait for the number of seconds given in Retry-After and try again |
The key is lost
A key is shown only once, right after you create it. We store it only as a hash and can't show it again. Create a new key, enter it in your tool and then delete the old one.
The key was shared or is public
- Open API Key and click Deactivate next to the affected key. It's rejected from that moment on.
- Create a new key and enter it in your tools.
- Delete the old key once everything is working again.
- Check the Call History for outbound calls you didn't trigger.
Further help
Send us the key's name or the key hint from API Key, the time of the request and the API's response, see Report a problem. We never need the full key.
Was this page helpful?