Skip to content

Authentication Failures

Authentication failures usually come from using the wrong key type, missing scopes, or missing RBAC access.

Status Codes

  • 401: The credential is missing, malformed, expired, revoked, or sent to the wrong base URL.
  • 403: The credential is valid but lacks scope or resource permission.

Checklist

  • Use a user API key for management automation.
  • Use a customer key for runtime preflight and usage logging.
  • Confirm management scopes such as management:read, management:write, webhooks:read, and webhooks:write.
  • Confirm customer key scopes such as preflight:read and usage:write.
  • Confirm the caller has viewer, editor, or owner access to the organization or resource.
  • Confirm webhooks calls use SPENDWARE_WEBHOOKS_BASE_URL when the webhooks API runs separately.

Example Header

Authorization: Bearer SPENDWARE_API_KEY

Do not log this header. Log only the request ID and key prefix.