Symptoms
- Authentication fails immediately on every model.
- Rotating to a newly copied key resolves the request.
Likely causes
- The value is truncated, includes quotes or whitespace, or belongs to another service.
- The client sends an account/session token instead of a TokenReply API key.
How to diagnose
- Compare only a masked prefix and length; never log the full key.
- Check which credential source the running process actually loaded.
- Try a newly created, narrowly scoped key in a minimal request.
Fixes
- Copy a TokenReply API key again and remove surrounding quotes or whitespace.
- Update the correct runtime secret, then restart only the process that caches it.
- Revoke any key that may have been exposed.
How to verify
A minimal request authenticates with the replacement key and the old key remains revoked.