# `UNAUTHENTICATED` (HTTP 401): no valid API key was sent

The Authorization header is missing, malformed, or carries a key that does not exist or was revoked.

Every endpoint under /api/v1 except the browser endpoint and the bounce webhooks authenticates with a secret key sent as a bearer token: Authorization: Bearer sk_live_… . Keys are shown once at creation and stored hashed, so a key you cannot find cannot be recovered.

Revoking a key from the dashboard stops its requests immediately with this code.

**What to do.** Send the header exactly as Authorization: Bearer followed by the key. If the key is lost, create a new one on the API keys page and retire the old one.

```json
{
    "success": false,
    "error": {
        "code": "UNAUTHENTICATED",
        "message": "Provide a valid API key as a bearer token.",
        "request_id": "req_01m1kgdm4xngzmbmff68g94w0c"
    }
}
```

Reference: https://spaw.co/docs/errors/UNAUTHENTICATED