Resolve API access errors

Identify the status

A 401 response means the API could not accept the credential. Check that the request has one non-empty x-api-key header and that the key has not expired, been revoked, or been disabled.

A 403 response means the credential was recognized but the request is not allowed. Common checks include the key's endpoint permissions, the owner's current workspace access, whether the operation permits API key access, and any IP allow-list on the key.

Do not send both x-api-key and Authorization. Threetone rejects requests that contain both credentials.

Work through the request

1. Confirm the request is going to https://api.threetone.in and the intended /v1/... path.
2. Replace the key with the exact value from your secret store. Do not use the masked preview shown in the dashboard.
3. Check the key on API Keys for expiration, disabled state, permissions, and IP restrictions.
4. Confirm the key belongs to the intended user or workspace service account.
5. If the secret may have leaked, revoke it and create a replacement instead of continuing to test it.

Keep the error evidence

API errors use a detail object with a machine-readable status, a message, and a request_id for most authentication and authorization failures. Keep the response status, body, and X-Request-Id header. Share the request ID when asking for support, but never share the API key.