invalid-credentials

A problem type of the ckrets.ai API, answered with 401. The answer is application/problem+json (RFC 9457) with type https://ckrets.ai/problems/invalid-credentials, title, status, detail and requestId. Branch on type, never on title.

#401: prove who you are

The Authorization header is not a valid credential (unknown, revoked, ended or malformed, or not Bearer <credential> at all: Basic, Token, a bare Bearer; the word Bearer itself may be in any case). It is refused on every route, even one that needs no credential (a bearer reveal, GET /v1/limits): send no header rather than a bad one. A well-formed manage token (ckm_ and 26 uppercase Crockford base32 characters) is not an invalid credential, even one we never issued: everywhere but its own secret's status, revoke and policy it counts as no credential, so the caller is anonymous (a create with it makes an anonymous secret, 201; GET /v1/limits answers the anonymous tier, 200; /v1/me/key, which needs a key, answers 401). A manage token that is not its secret's is 403 not-creator on status and revoke. A ckm_ of any other form is 401 invalid-credentials.

#More

• Every type, grouped by what to do: error types.
• The retry rules and headers: limits.
• This page for agents, as Markdown: /problems/invalid-credentials.md.