janhq/jan · error · Error

Authentication failed: API key is required or invalid for ${

Error message

Authentication failed: API key is required or invalid for ${provider.provider}

What it means

Thrown by TauriProviderService.fetchModelsFromProvider (providers/tauri.ts:203) when the GET ${base_url}/models request returns 401 after key rotation is exhausted (last key attempt, or status not eligible for further rotation). The provider rejected the API key as missing or invalid. Rotation already attempted all keys before this fires.

Source

Thrown at web-app/src/services/providers/tauri.ts:203

        const response = await fetchTauri(`${provider.base_url}/models`, {
          method: 'GET',
          headers,
        })

        lastStatus = response.status
        lastStatusText = response.statusText

        if (
          [401, 403, 429].includes(response.status) &&
          ki < keyAttempts.length - 1
        ) {
          continue
        }

        if (!response.ok) {
          if (response.status === 401) {
            throw new Error(
              `Authentication failed: API key is required or invalid for ${provider.provider}`
            )
          }
          if (response.status === 403) {
            throw new Error(
              `Access forbidden: Check your API key permissions for ${provider.provider}`
            )
          }
          if (response.status === 404) {
            throw new Error(
              `Models endpoint not found for ${provider.provider}. Check the base URL configuration.`
            )
          }
          throw new Error(
            `Failed to fetch models from ${provider.provider}: ${response.status} ${response.statusText}`
          )
        }

View on GitHub (pinned to fad3f12a14)

Solutions

Re-issue the API key at the provider's dashboard and update it in Settings > Model Providers.
Confirm the key is actually being sent (not empty) and via the header scheme the provider expects.
If behind a proxy, verify it forwards the Authorization / x-api-key header.
Check the provider account is active and the key has model-list scope.

Example fix

// before
if (response.status === 401) {
  throw new Error(`Authentication failed: API key is required or invalid for ${provider.provider}`)
}
// after: hint at the specific cause when no key was configured at all
if (response.status === 401) {
  const hadKey = keyAttempts.some(k => k)
  throw new Error(hadKey
    ? `Authentication failed: API key rejected by ${provider.provider}. Re-issue the key.`
    : `Authentication failed: no API key set for ${provider.provider}. Add one in Settings.`)
}

Defensive patterns

Strategy: try-catch

Validate before calling

function hasValidKeyForProvider(p: ModelProvider): boolean {
  const chain = providerRemoteApiKeyChain(p)
  return chain.some(k => typeof k === 'string' && k.trim().length > 0)
}
// before fetchModelsFromProvider:
if (!hasValidKeyForProvider(provider)) {
  throw new Error(`Set an API key for ${provider.provider} in Settings.`)
}

Type guard

function isAuthError(e: unknown, provider: string): boolean {
  return e instanceof Error && /Authentication failed.*provider/i.test(e.message)
}

Try / catch

try {
  return await providerService.fetchModelsFromProvider(provider)
} catch (e) {
  if (e instanceof Error && /Authentication failed/.test(e.message)) {
    openSettings('model-providers', provider.provider)
    return []
  }
  throw e
}

Prevention

Validate the key is non-empty before the network call.
Confirm the auth header scheme matches what the provider expects.
Surface 're-issue the key' guidance distinctly from network errors.
Strip whitespace from keys on save.

When it happens

Trigger: The /models endpoint responds 401 on the final key attempt: every key in the keyChain is invalid/revoked, the key field is empty so no auth header was sent, or the provider requires a different auth scheme (e.g. x-goog-api-key but x-api-key was sent).

Common situations: API key expired or revoked; key never set (empty); wrong auth header mode for this provider; corporate proxy strips the Authorization header; provider's account is suspended.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of janhq/jan@fad3f12a14 (2026-08-12). Data as JSON: /api/errors/718fc16f1fe48e05. Report an issue: GitHub.