Skip to content
Prokure Docs

Fixing 401 and 403 errors

Both statuses mean the request was refused on credential grounds, but they point at different fixes. Read the error code in the body rather than branching on the status alone.

401 unauthorized means no credential was presented, or the key is unknown, revoked, or expired. Check that the header arrived, that the whole pk_live_ string was sent, and that the key has not been revoked or passed its expiry.

403 insufficient_scope means the key is valid but was minted without a scope this route requires. The message names the missing scope:

{
  "error": "insufficient_scope",
  "message": "this key lacks the opportunities:read scope",
  "requestId": "req-4f2"
}

Scopes are fixed at creation, so the fix is a new key with the wider set.

403 forbidden means the credential is valid but not permitted to perform this action.

Codes you should not see on a key

Section titled “Codes you should not see on a key”

no_membership, membership_disabled, unverified_email and identity_conflict are also 403, but they concern browser sessions. Seeing one from a key-authenticated request means something other than scopes is wrong.

Do not retry either

Section titled “Do not retry either”

A 401 or 403 means the request or the credential is wrong, and sending it again unchanged produces the same result. Only 429 and 5xx are worth retrying. Log the requestId from the error body, which identifies that exact request.

Section titled “Related”