Authentication 401 api proxy

Error 401 Unauthorized

Error 401 means the API request was not authenticated. In AI API proxy workflows, it usually points to a missing API key, wrong token, revoked key, malformed Authorization header, or a provider profile that sends the request to a different API than expected.

Snapshot

A 401 is an authentication failure. Check which key is loaded, which Base URL receives the request, whether the header format is correct, and whether the key is still active for that provider.

#error 401 #401 unauthorized #openai api 401 #claude code 401 #codex 401 #invalid api key

What Error 401 Means

Error 401 means the request reached an API endpoint, but the endpoint could not authenticate it.

For AI API proxies, this usually means the key, token, header format, or provider profile does not match the Base URL receiving the request.

Common Causes

  1. The API key is missing, empty, copied with extra spaces, revoked, expired, or belongs to another provider account.
  2. The Authorization header is malformed, such as missing the Bearer prefix for OpenAI-compatible APIs or using the wrong header for Anthropic-compatible APIs.
  3. The Base URL points to a different provider than the key was issued for, for example using an Anthropic key against an OpenAI-compatible proxy profile.
  4. Claude Code, Codex, Cursor, shell environment variables, or config.toml is reading an old key instead of the key you just edited.
  5. The proxy account is disabled, not activated, not allowed to call the selected model, or requires a different project, organization, or workspace setting.

How To Fix It

  1. Print or inspect the active environment variables and config files used by the tool, especially OPENAI_API_KEY, ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, and any provider-specific key.
  2. Confirm the Base URL and API key come from the same provider profile. Do not mix official OpenAI, Anthropic, and third-party proxy keys unless the provider explicitly documents that format.
  3. Check the request header format. OpenAI-compatible endpoints normally expect Authorization: Bearer YOUR_KEY, while Anthropic-compatible endpoints may use provider-specific auth headers.
  4. Create a fresh key in the provider dashboard and test one minimal request before changing complex Claude Code, Codex, Cursor, or CC Switch profiles.
  5. If the same key works in curl but fails in a CLI, restart the terminal or app and check whether another config file is overriding the expected key.

Checks For API Proxy Users

Test with the exact Base URL, API key, and model name used by the failing tool. A successful request with another key or another endpoint does not prove this profile is valid.

If a new key works in curl but fails in the CLI, the CLI is probably reading a stale environment variable, an old profile, or a different configuration file.

When To Change Provider

Change providers only after confirming the current key is disabled, the provider does not support the required auth flow, or the model is unavailable for your account. Most 401 errors are local configuration problems.

Related errors

Claude Code / Codex 503 No available accounts Do not rotate keys first. This error usually points to an unavailable account pool, provider, group, or model route. Test a minimal request, confirm the model and group, then decide whether to wait, reduce context, change model, or switch provider. Codex: Selected model is at capacity. Error: Selected model is at capacity. Please try a different model. Treat it as model-level capacity, admission, or streaming interruption first. It can happen with ChatGPT-authenticated Codex CLI, proxy account pools, or Sub2API upstream overloaded passthrough. Codex warning: Your conversation has multiple possible cybersecurity risk flags Warning: Your conversation has multiple possible cybersecurity risk flags. Treat it as an OpenAI/Codex safety-routing signal first, then check whether an API proxy, sensitive keywords, long code context, or opaque model routing is making it worse. Error 429 Too Many Requests for AI API proxies Error: exceeded retry limit, last status: 429 Too Many Requests, request id: <request-id>. With an AI API proxy, repeated 429s usually mean the upstream account pool is rate limited, cooling down, or out of usable quota. Ask the provider to switch account, route, or model first.

Related guides

Quickstart: connect Claude Code, Codex, or Cursor to an AI API proxy Before connecting Claude Code, Codex, or Cursor to an AI API proxy, confirm the tool, protocol compatibility, Base URL, API key, and model name. Codex OpenAI-compatible proxy Base URL setup guide Install the OpenAI Codex CLI and configure API keys, Base URL, config.toml, and provider switching for an OpenAI-compatible proxy. Claude Code API proxy Base URL setup guide Configure Claude Code with an API proxy using ANTHROPIC_BASE_URL, ANTHROPIC_AUTH_TOKEN, and ANTHROPIC_API_KEY.

Related topics

OpenAI API Proxy Providers Compare OpenAI API proxy and OpenAI-compatible providers by Base URL support, models, pricing, payment methods, and public verification signals. Claude API Proxy Providers Compare Claude API proxy and Anthropic-compatible providers by models, Base URL setup, pricing notes, payment methods, and verification signals. AI API Directory Browse an AI API directory of OpenAI-compatible, Claude-compatible, and multi-model proxy providers with pricing, payment, model, and verification fields.

FAQ

Common questions

Is Error 401 the same as Error 403?

No. A 401 usually means the request is not authenticated. A 403 usually means the request was authenticated but the account is not allowed to perform that action.

Why does the key work in one tool but fail in Codex or Claude Code?

Different tools may read different environment variables, config files, provider profiles, or auth headers. Check the exact key and Base URL loaded by the failing tool.

Should I switch API proxy providers after a 401?

Not first. A 401 is most often a key, header, or profile mismatch. Switch providers only after confirming the current provider has disabled the key or does not support the required authentication flow.