Fix 401 INVALID_API_KEY and API_KEY_REQUIRED

Why BigModel.io returns 401 INVALID_API_KEY, API_KEY_REQUIRED or API_KEY_DISABLED, how to send the key correctly for OpenAI and Anthropic clients, and how to check which key is used.

On this page
  1. What it means
  2. How to fix it
  3. Troubleshooting
  4. Related

The request reached BigModel.io, but the key was missing, mistyped or turned off:

json
{ "code": "INVALID_API_KEY", "message": "Invalid API key", "error": { "message": "Invalid API key", "type": "authentication_error", "code": "INVALID_API_KEY" } }

#What it means

code Cause
API_KEY_REQUIRED No key in the request
INVALID_API_KEY The key is not a BigModel.io key, or it was copied incompletely
API_KEY_DISABLED The key exists but is disabled
USER_INACTIVE The account behind the key is not active

Keys from other platforms, including bigmodel.cn, do not work on BigModel.io.

#How to fix it

  1. Copy the key again from API Keys. The copy button always copies the full key.
  2. Send it in a header, never in the URL:
bash
curl https://bigmodel.io/v1/models -H "Authorization: Bearer $BIGMODEL_API_KEY"

Anthropic-style clients may use x-api-key: $BIGMODEL_API_KEY instead. Keys sent as ?key= return 400 api_key_in_query_deprecated.

  1. Check which key your tool actually uses. An old key often stays in an environment variable or a settings file. Print only the first characters to compare with the console:
bash
echo "${BIGMODEL_API_KEY:0:8}"
  1. If the key shows as disabled in the console, enable it or create a new one.

#Troubleshooting

Claude Code reports an auth conflict. Both ANTHROPIC_API_KEY and ANTHROPIC_AUTH_TOKEN are set. Keep ANTHROPIC_AUTH_TOKEN and run unset ANTHROPIC_API_KEY. See Claude Code.

Calling from a web page. Don't: the key would be visible to anyone who opens the page. Call the API from your server.

You think the key leaked. Disable it at once and create a new one. See Authentication.

Updated · View as Markdown