401 Bad signature

The key is correctly shaped but its signature does not verify, so it was not issued by us.

Every key carries a short signature derived from its identifier. We check it with pure CPU and no database lookup, which is what lets us reject forged keys cheaply.

Common causes

A character was altered. One transposed or dropped character in the middle of the key leaves the length intact but breaks the signature — this is the usual cause when the key “looks right”.

A key from a different environment. Keys minted against a different signing secret will not verify here.

A hand-constructed key. The format is documented, but the signature cannot be produced without our signing secret. This is deliberate.

Copy the key again from your dashboard. If it still fails, revoke it and create a new one.