# invalid-credentials

`https://ckrets.ai/problems/invalid-credentials` is a problem type of the ckrets.ai API (RFC 9457: the body is
`application/problem+json` with `type`, `title`, `status` and `detail`; every problem from `/v1` also carries `requestId`).

| Status | Also in the answer | What to do |
|---|---|---|
| 401 | - | the `Authorization` header is not a valid credential (unknown, revoked, ended or malformed, or not `Bearer <credential>` at all: `Basic`, `Token`, a bare `Bearer`; the word `Bearer` itself may be in any case). It is refused on every route, even one that needs no credential (a bearer reveal, `GET /v1/limits`): send no header rather than a bad one. A well-formed manage token (`ckm_` and 26 uppercase Crockford base32 characters) is not an invalid credential, even one we never issued: everywhere but its own secret's status, revoke and policy it counts as no credential, so the caller is anonymous (a create with it makes an anonymous secret, `201`; `GET /v1/limits` answers the anonymous tier, `200`; `/v1/me/key`, which needs a key, answers `401`). A manage token that is not its secret's is `403 not-creator` on status and revoke. A `ckm_` of any other form is `401 invalid-credentials` |

Every type, with its retry rule and headers: [limits.md, "Errors, retries and headers"](/limits.md#errors-retries-and-headers).