The API returns 401 or 403
The usual reasons a call is refused: a missing or wrong key, a key from another app, a publishable key writing, or a key limited to tables calling a function.
Last updated September 17, 2026
| Answer | Cause | Fix |
|---|---|---|
401 unauthorized | No key, a mistyped, revoked or expired key, or a key from a different app | Send the key in an X-Api-Key header, copied whole, from the app whose address you are calling |
403 secret_key_in_browser | A secret key was used from a page | Move the call to a server, or use a publishable key |
403 read_only_key | A publishable or read-only key tried to write | Use a secret key with full access |
403 key_too_narrow | A key limited to named tables called a function | Make a key without a table limit |
404 not_published | The app has never been published | Publish it |
The Logs tab lists every refused call with its reason. The full list of errors is in the API error reference.
Was this page helpful?
Still need help? Contact support