Fix a Missing or Invalid UPCS x-api-key

A 401 response about the API key means the request either carried no x-api-key header or carried a key UPCS does not recognise. The request never gets as far as your data.

Symptom

Server-to-server calls such as /v1/upcs/lookup/{code}, /v1/upcs/generate, /v1/embed/resolve or /v1/embed/sessions return HTTP 401 with success: false and a message about a missing or invalid key.

Likely causes

• The header is missing, misspelled, or sent under another name such as Authorization.
• The key has extra spaces, line breaks or quotation marks copied with it.
• An environment variable is empty or not loaded in production.
• A key from an old or different account is in use.

Fix it step by step

1. Confirm the header name is exactly x-api-key.
2. Print the length of the key in your code (not the key itself) and compare it with the key in the partner panel. Remove stray whitespace and quotes.
3. Check that the environment variable or setting holds the key on the server where the code actually runs.
4. Make sure the key starts with upcs_ and is the one shown in the partner panel.
5. Send the request to the HTTPS base https://api.upcs.io/api.
6. If the message is "Invalid or inactive API key" (a wrong, disabled or expired key), follow 401 invalid or inactive key.

Confirm it is fixed

Repeat a simple lookup call with the corrected header. A valid key returns data, or a 404 for an unknown code, which means authentication succeeded. See lookup returns 404.

When to contact support

If a freshly copied active key is still rejected, contact support with the endpoint, time of the request and the first and last four characters of the key only.