🔍 What a 401 error means
A 401 Unauthorized response with "Bad API key" means Search Atlas could not authenticate the credential sent with the request. This usually results from an incorrect key, an unsupported header format, a hidden character, or using a key from the wrong environment.
✅ Check the API key and request format
- Locate your API key in your Search Atlas account settings.
- Confirm you copied the complete production key. Do not include quotation marks, spaces, line breaks, or other surrounding characters.
- Review the endpoint documentation and use the required authentication header exactly as shown. Do not substitute a JWT, session token, or an older authentication format.
- Confirm the request is sent over HTTPS and that your HTTP client is not removing or rewriting the authentication header.
- Test with a simple request from a tool such as cURL or Postman before testing through your application.
🧪 Test with a clean request
Create a new request using one documented endpoint and the current production base URL. Add only the required headers, including the API key header specified in the documentation. Avoid copying headers from a browser session, cached environment variables, or another integration.
If the request works in cURL or Postman but fails in your application, compare the final outgoing request. Check for an empty environment variable, truncated value, extra whitespace, incorrect capitalization, or middleware that replaces the API key.
🔄 Rotate the key safely
If the key still returns 401, generate a new API key from your Search Atlas account settings and update the integration. Store it securely as a secret, then retry the request. Do not publish API keys in source code, browser-side scripts, screenshots, logs, or support messages.
After confirming the new key works, remove or revoke the old key if it is no longer needed. When rotating keys in production, update all services that use the credential before disabling the previous key.
⚠️ Check endpoint and account access
API key authentication is supported on customer-facing endpoints documented for API-key access. Some specialized actions or connectors may require a different authentication method or may not support API keys. Verify that the endpoint, HTTP method, account, and production environment match the documentation.
🛠️ When to contact Search Atlas
If newly generated production keys continue to return 401 on documented endpoints after completing these checks, have the following ready when you reach out: the endpoint path, HTTP method, response status, response message, and a redacted request example showing only the header names (never the key values). This information allows the team to investigate your account's API access quickly.
If you need further assistance, open the chat widget in the bottom-right corner of the platform and type human teammate to be connected with a member of our team.