What causes "Authentication failed, check your API Key" in Sonarr/Sonarr?

Open NZBVortex's settings/preferences and copy the current API key, then paste it into Sonarr > Settings > Download Clients > NZBVortex > API Key.

Sonarr/Sonarr · error · NzbVortexAuthenticationException

Authentication failed, check your API Key

Error message

Authentication failed, check your API Key

What it means

Thrown as NzbVortexAuthenticationException when NZBVortex's auth/login endpoint returns NzbVortexLoginResultType.Failed. NZBVortex uses a nonce/cnonce challenge-response scheme: Sonarr requests a server nonce, generates a client nonce, computes SHA256(nonce:cnonce:apiKey), and sends the hash. If NZBVortex cannot validate the hash against its stored API key, it returns a Failed login result and Sonarr throws this exception. The session ID is never cached, so every subsequent request that triggers re-authentication will fail again.

Source

Thrown at src/NzbDrone.Core/Download/Clients/NzbVortex/NzbVortexProxy.cs:207

                var nonce = Json.Deserialize<NzbVortexAuthNonceResponse>(nonceResponse.Content).AuthNonce;

                var cnonce = Guid.NewGuid().ToString();

                var hashString = string.Format("{0}:{1}:{2}", nonce, cnonce, settings.ApiKey);
                var hash = Convert.ToBase64String(hashString.SHA256Hash().HexToByteArray());

                var authRequest = BuildRequest(settings).Resource("auth/login")
                                                        .AddQueryParam("nonce", nonce)
                                                        .AddQueryParam("cnonce", cnonce)
                                                        .AddQueryParam("hash", hash)
                                                        .Build();
                var authResponse = _httpClient.Execute(authRequest);
                var authResult = Json.Deserialize<NzbVortexAuthResponse>(authResponse.Content);

                if (authResult.LoginResult == NzbVortexLoginResultType.Failed)
                {
                    throw new NzbVortexAuthenticationException("Authentication failed, check your API Key");
                }

                sessionId = authResult.SessionId;

                _authSessionIdCache.Set(authKey, sessionId);
            }

            requestBuilder.AddQueryParam("sessionid", sessionId);
        }
    }
}

View on GitHub (pinned to da2284d7ea)

Solutions

Open NZBVortex's settings/preferences and copy the current API key, then paste it into Sonarr > Settings > Download Clients > NZBVortex > API Key.
Verify the API key has no leading/trailing whitespace after pasting (Sonarr does not trim it automatically).
If unsure whether the key is correct, regenerate a new API key in NZBVortex and update both sides.
Test the connection using the 'Test' button in Sonarr's download client settings after updating.

Example fix

// before: stale API key
var settings = new NzbVortexSettings { ApiKey = "old-or-wrong-key" };

// after: key copied verbatim from NZBVortex preferences
var settings = new NzbVortexSettings { ApiKey = "abc123-exact-key-from-nzbvortex" };

Defensive patterns

Strategy: validation

Validate before calling

// Validate API key format before attempting authentication
public bool IsApiKeyValidFormat(string apiKey)
{
    if (string.IsNullOrWhiteSpace(apiKey)) return false;
    if (apiKey.Length < 8) return false;
    if (apiKey.Any(char.IsWhiteSpace)) return false;
    return true;
}

Type guard

public bool IsNzbVortexAuthLikelyValid(NzbVortexSettings settings)
{
    return !string.IsNullOrWhiteSpace(settings.ApiKey)
        && !settings.ApiKey.Any(char.IsWhiteSpace)
        && settings.ApiKey.Length >= 8;
}

Try / catch

try
{
    _proxy.AuthenticateClient(requestBuilder, settings);
}
catch (NzbVortexAuthenticationException ex)
{
    _logger.Error(ex, "NZBVortex API key is incorrect — update settings");
    // Do NOT retry — auth failure is persistent until config changes
    throw;
}

Prevention

Copy the API key directly from NZBVortex's preferences screen using copy-paste, not manual typing.
Trim whitespace from pasted API keys (some UIs add trailing spaces).
After changing the API key in NZBVortex, update Sonarr immediately to prevent repeated auth failures.
Use the 'Test' button after configuring the API key to verify before closing settings.

When it happens

Trigger: The API Key in Sonarr's NZBVortex settings does not match the API key configured in the NZBVortex application. The authentication flow (lines 187-208) fetches a nonce, computes SHA256(nonce:cnonce:apiKey), posts to auth/login, and deserializes the response — if LoginResult equals Failed, the exception fires.

Common situations: The API key was regenerated in NZBVortex but not updated in Sonarr; the API key was copy-pasted with trailing whitespace or a typo; NZBVortex was reinstalled/reset and got a new key; the user confused the API key with the web UI password.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of Sonarr/Sonarr@da2284d7ea (2026-08-13). Data as JSON: /api/errors/3d97a2606cbcef56. Report an issue: GitHub.