# Fix 401 INVALID_API_KEY and API_KEY_REQUIRED

> Why BigModel.io returns 401 INVALID_API_KEY, API_KEY_REQUIRED or API_KEY_DISABLED, how to send the key correctly for OpenAI and Anthropic clients, and how to check which key is used.

Web version: https://bigmodel.io/docs/error-invalid-api-key · Updated 2026-10-27

The request reached BigModel.io, but the key was missing, mistyped or turned off:

```json
{ "code": "INVALID_API_KEY", "message": "Invalid API key", "error": { "message": "Invalid API key", "type": "authentication_error", "code": "INVALID_API_KEY" } }
```

## What it means

| `code` | Cause |
|---|---|
| `API_KEY_REQUIRED` | No key in the request |
| `INVALID_API_KEY` | The key is not a BigModel.io key, or it was copied incompletely |
| `API_KEY_DISABLED` | The key exists but is disabled |
| `USER_INACTIVE` | The account behind the key is not active |

Keys from other platforms, including bigmodel.cn, do not work on BigModel.io.

## How to fix it

1. Copy the key again from [API Keys](https://bigmodel.io/keys). The copy button always copies the full key.
2. Send it in a header, never in the URL:

```bash
curl https://bigmodel.io/v1/models -H "Authorization: Bearer $BIGMODEL_API_KEY"
```

Anthropic-style clients may use `x-api-key: $BIGMODEL_API_KEY` instead. Keys sent as `?key=` return 400 `api_key_in_query_deprecated`.

3. Check which key your tool actually uses. An old key often stays in an environment variable or a settings file. Print only the first characters to compare with the console:

```bash
echo "${BIGMODEL_API_KEY:0:8}"
```

4. If the key shows as disabled in the console, enable it or create a new one.

## Troubleshooting

**Claude Code reports an auth conflict.** Both `ANTHROPIC_API_KEY` and `ANTHROPIC_AUTH_TOKEN` are set. Keep `ANTHROPIC_AUTH_TOKEN` and run `unset ANTHROPIC_API_KEY`. See [Claude Code](https://bigmodel.io/docs/claude-code).

**Calling from a web page.** Don't: the key would be visible to anyone who opens the page. Call the API from your server.

**You think the key leaked.** Disable it at once and create a new one. See [Authentication](https://bigmodel.io/docs/authentication).

## Related

- [Authentication](https://bigmodel.io/docs/authentication)
- [Quickstart](https://bigmodel.io/docs/quickstart)
- [Error codes and responses](https://bigmodel.io/docs/errors)