The API returns 401 or 403

Quick answer

A 401 means the key is missing, wrong or revoked, or it was sent from the wrong place. A 403 means the key is fine but isn’t allowed to do that call.

401

• Send the key as Authorization: Bearer <key> or X-Api-Key: <key>.
• A publishable key (pk_) only works from the origins registered on it. Add your site’s exact origin, including https:// and any www..
• A secret key (sk_) is refused from a browser. Move the call to your server.
• A revoked key stops working at once. Create a new one in Billing & Usage.

403

• secret_key_required: sales, order status and reorder requests need a secret key.
• scope_not_permitted: the family isn’t enabled for your account, isn’t available to the key’s class, or wasn’t granted to the key. Check your capabilities document.

429 means the key’s daily or monthly quota is used. It resets at 00:00 UTC each day and on the 1st of the month.

Full guide

• Errors and rate limits
• Authentication and keys