Invalid API key. Organization-scoped API key required for th

Error message

Invalid API key. Organization-scoped API key required for this operation.

What it means

HTTP 403 raised when the authenticated key is valid but is a project-scoped key. This admin endpoint only accepts organization-scoped keys (accessLevel === 'organization' with an orgId).

Source

Thrown at web/src/pages/api/public/organizations/apiKeys/index.ts:43

  // CHECK AUTH
  const authCheck = await new ApiAuthService(
    prisma,
    redis,
  ).verifyAuthHeaderAndReturnScope(req.headers.authorization);
  if (!authCheck.validKey) {
    return res.status(401).json({
      error: authCheck.error,
    });
  }
  // END CHECK AUTH

  // Check if using an organization API key
  if (
    authCheck.scope.accessLevel !== "organization" ||
    !authCheck.scope.orgId
  ) {
    return res.status(403).json({
      error:
        "Invalid API key. Organization-scoped API key required for this operation.",
    });
  }

  if (
    !hasEntitlementBasedOnPlan({
      plan: authCheck.scope.plan,
      entitlement: "admin-api",
    })
  ) {
    return res.status(403).json({
      error: "This feature is not available on your current plan.",
    });
  }

  const rateLimitCheck = await RateLimitService.getInstance().rateLimitRequest(
    authCheck.scope,

View on GitHub (pinned to 59d92c7cf3)

Solutions

Create and use an organization-scoped API key (Organization settings > API Keys)
If you only need project data, use /api/public/... project endpoints instead

Defensive patterns

Strategy: validation

Validate before calling

// Only call admin endpoints when the key is org-scoped: org keys created in Organization settings; verify by listing keys via UI.

Try / catch

try { ... } catch (e) { if (e.status === 403) checkKeyScope(); }

Prevention

Keep org keys and project keys in separately named env vars
Name env vars ORG_LANGFUSE_PK vs LANGFUSE_PK to avoid mixups

When it happens

Trigger: Calling /api/public/organizations/apiKeys with a project-scoped pk-lf/sk-lf key, or with an organization key that has no orgId resolved.

Common situations: Using the default project API keys from the project settings page instead of keys created under Organization > API Keys.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of langfuse/langfuse@59d92c7cf3 (2026-08-27). Data as JSON: /api/errors/61339896b9c34fab. Report an issue: GitHub.