unauthorized

HTTP 401

When you see this

Canopy checks the key first on every /api/v1/* request. Two cases return this code:

• The Authorization header is missing, or is not exactly Authorization: Bearer <token>. The message reads "A bearer token is required."
• The token is unknown, revoked, or a publishable key instead of a secret key. The message reads "The bearer token is invalid, revoked, or not a secret key." See the credentials guide for the prefix each key type uses.

The publishable key is the most common cause. It belongs in the browser, as the merchant field passed to the checkout SDK's mount(). The secret key is for server-to-server calls to this API.

What the response looks like

{
  "error": {
    "code": "unauthorized",
    "message": "The bearer token is invalid, revoked, or not a secret key.",
    "request_id": "req_1a2b3c4d5e6f7a8b9c0d1e2f",
    "docs": "https://canopypay.io/errors/unauthorized"
  }
}

param is never present. The whole credential is wrong, not one field.

What to do

Send Authorization: Bearer <secret key> with your secret key, not the publishable one. If you rotated or revoked the key, create a new one and update your server.

After a rotation, the old key works only until its overlap window ends. A revoked key never works again. Fix this on your side. Retrying the same request fails the same way.