langfuse/langfuse · error · Error

Unauthorized: Cannot use organization key with bearer auth

Error message

Unauthorized: Cannot use organization key with bearer auth

What it means

Error thrown when a Bearer-auth request resolves to an ORGANIZATION-scoped key: organization keys must not be used with bearer auth on these endpoints, since org keys authorize differently than project keys.

Source

Thrown at web/src/features/public-api/server/apiAuth.ts:215

                rateLimitOverrides: finalApiKey.rateLimitOverrides ?? [],
                apiKeyId: finalApiKey.id,
                scope: finalApiKey.scope,
                publicKey: finalApiKey.publicKey,
                isIngestionSuspended: finalApiKey.isIngestionSuspended,
                isInAppAgentKey: finalApiKey.isInAppAgentKey,
              },
            };

            return result;
          }
          // Bearer auth, limited scope, only needs public key
          if (authHeader.startsWith("Bearer ")) {
            const publicKey = authHeader.replace("Bearer ", "");

            const dbKey = await this.findDbKeyOrThrow(publicKey);

            if (dbKey.scope === "ORGANIZATION") {
              throw new Error(
                "Unauthorized: Cannot use organization key with bearer auth",
              );
            }

            const { orgId, cloudConfig, cloudFreeTierUsageThresholdState } =
              this.extractOrgIdAndCloudConfig(dbKey);
            const plan = getOrganizationPlanServerSide(cloudConfig);

            addUserToSpan(
              {
                projectId: dbKey.projectId ?? undefined,
                orgId,
                plan,
                apiKeyId: dbKey.id,
                publicKey: dbKey.publicKey,
              },
              span,
            );

View on GitHub (pinned to 59d92c7cf3)

Solutions

1. Use a project-scoped key with Bearer auth for these calls
2. Use the org key only with the ingestion endpoints that accept it
3. Switch to Basic auth with a project secret key for management APIs

Example fix

// before
Authorization: Bearer <org-key>
// after
Authorization: Bearer <project-scoped-key>

// Determine key scope before choosing auth scheme
if (key.scope === 'ORGANIZATION') {
  // org keys are for ingestion endpoints only; use a project key here
  key = getProjectKey();
}

const isOrgScoped = (k: {scope: string}) => k.scope === 'ORGANIZATION';

try {
  await fetch('/api/public/...', { headers: { Authorization: `Bearer ${token}` } });
} catch (e) {
  if (e.message.includes('organization key with bearer auth')) {
    // swap to a project-scoped bearer key or Basic sk- auth
  }
}

When it happens

Trigger: Sending 'Authorization: Bearer <org-scoped key>' (e.g., an org-level ingestion key like laingub-... used as a bearer token) to an endpoint handled by verifyAuthHeaderAndReturnScope.

Common situations: Org-wide keys generated for OTLP ingestion reused for API calls; new org key feature adopted by scripts that previously used project bearer keys.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Missing projectId in scope. Are you using an organization ke
• ${authCheck.error}
• Access denied - need to use basic auth with secret key to ${
• No valid projectId found for auth token
• Access denied: Bearer auth and org api keys are not allowed

AI-assisted analysis of langfuse/langfuse@59d92c7cf3 (2026-08-27). Data as JSON: /api/errors/1a6f7932ab2cdaa3. Report an issue: GitHub.