{"record":{"id":"61339896b9c34fab","repo":"langfuse/langfuse","slug":"invalid-api-key-organization-scoped-api-key-requi","errorCode":null,"errorMessage":"Invalid API key. Organization-scoped API key required for this operation.","messagePattern":"Invalid API key\\. Organization-scoped API key required for this operation\\.","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"web/src/pages/api/public/organizations/apiKeys/index.ts","lineNumber":43,"sourceCode":"\n  // CHECK AUTH\n  const authCheck = await new ApiAuthService(\n    prisma,\n    redis,\n  ).verifyAuthHeaderAndReturnScope(req.headers.authorization);\n  if (!authCheck.validKey) {\n    return res.status(401).json({\n      error: authCheck.error,\n    });\n  }\n  // END CHECK AUTH\n\n  // Check if using an organization API key\n  if (\n    authCheck.scope.accessLevel !== \"organization\" ||\n    !authCheck.scope.orgId\n  ) {\n    return res.status(403).json({\n      error:\n        \"Invalid API key. Organization-scoped API key required for this operation.\",\n    });\n  }\n\n  if (\n    !hasEntitlementBasedOnPlan({\n      plan: authCheck.scope.plan,\n      entitlement: \"admin-api\",\n    })\n  ) {\n    return res.status(403).json({\n      error: \"This feature is not available on your current plan.\",\n    });\n  }\n\n  const rateLimitCheck = await RateLimitService.getInstance().rateLimitRequest(\n    authCheck.scope,","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/langfuse/langfuse/blob/59d92c7cf365150d10b753b5a0d1708902a2ed60/web/src/pages/api/public/organizations/apiKeys/index.ts#L25-L61","documentation":"HTTP 403 raised when the authenticated key is valid but is a project-scoped key. This admin endpoint only accepts organization-scoped keys (accessLevel === 'organization' with an orgId).","triggerScenarios":"Calling /api/public/organizations/apiKeys with a project-scoped pk-lf/sk-lf key, or with an organization key that has no orgId resolved.","commonSituations":"Using the default project API keys from the project settings page instead of keys created under Organization > API Keys.","solutions":["Create and use an organization-scoped API key (Organization settings > API Keys)","If you only need project data, use /api/public/... project endpoints instead"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Only call admin endpoints when the key is org-scoped: org keys created in Organization settings; verify by listing keys via UI.","typeGuard":null,"tryCatchPattern":"try { ... } catch (e) { if (e.status === 403) checkKeyScope(); }","preventionTips":["Keep org keys and project keys in separately named env vars","Name env vars ORG_LANGFUSE_PK vs LANGFUSE_PK to avoid mixups"],"tags":["authorization","http-403","organization-scope","public-api"],"backgroundTag":"insufficient-permissions","analyzedSha":"59d92c7cf365150d10b753b5a0d1708902a2ed60","analyzedAt":"2026-08-27T22:22:00.402Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}