# invalid_api_key

Missing, malformed, unknown, disabled, or expired API key. What causes the BioFlow API's invalid_api_key error (HTTP 401) and how to fix it.

HTTP 401 · `application/problem+json` · Missing, malformed, unknown, disabled, or expired API key.

## What causes it

- No `Authorization: Bearer` or `x-api-key` header was sent.
- The key is malformed, was revoked/disabled in the developer console, or has expired.

## How to fix it

- Create or roll a key in the developer console (Dashboard → Settings → Developers) and send it on every request.
- Check for whitespace or truncation — keys start with `bf_live_` or `bf_test_`.

## Example response body

```json
{
  "type": "https://getbioflow.com/docs/api/errors/invalid-api-key",
  "title": "Missing, malformed, unknown, disabled, or expired API key",
  "status": 401,
  "instance": "urn:request:req_01abc",
  "code": "invalid_api_key",
  "request_id": "req_01abc"
}
```

Branch on the stable `code` field — `title` and `detail` are for humans and may
change. `type` (`https://getbioflow.com/docs/api/errors/invalid-api-key`) always resolves to this page. Quote
`request_id` when contacting support. Full code registry on the
[API docs hub](/docs/api#errors); the complete surface is in the
[interactive reference](/docs/api-reference).