401 · Troubleshooting
Troubleshoot API 401 errors: API keys, authentication headers and URLs
Last updated：
A 401 means that request failed authentication, but it does not always mean the key itself expired. Credentials from another service, incorrect headers, duplicated paths or stale environment variables can make an otherwise valid key fail. Fix a minimal request and check one setting at a time.
1. Record the failed request
Record the final domain/path, HTTP status, protocol, model ID, timestamp, error fields and available request ID. Share only redacted details; omit complete Authorization headers and API keys.
The website tikway.ai and API api.tikway.ai serve different purposes. Send model requests to the API domain using the appropriate protocol.
2. Match authentication to the protocol
| Protocol | Text request path | Example authentication |
|---|---|---|
| OpenAI Chat Completions | /v1/chat/completions |
Authorization: Bearer YOUR_KEY |
| Anthropic Messages | /v1/messages |
x-api-key: YOUR_KEY plus anthropic-version: 2023-06-01 |
| Gemini generateContent | /v1beta/models/{MODEL_ID}:generateContent |
x-goog-api-key: YOUR_KEY |
Follow the authentication documentation, currently in Chinese, and the actual error. These common combinations do not establish that every credential or route accepts interchangeable headers.
3. Check the key the process actually uses
Use a key created in your Tikway account, with no extra spaces or newlines. Check whether a terminal, container or IDE reads an old environment. Verify that the key was not deleted, disabled or permission-restricted. Test for presence without printing its value.
Explicit SDK settings, variables, configuration files and client-provider settings can coexist. Editing a file the process does not read will not change the actual request.
4. Check base URL concatenation
OpenAI SDK’s https://api.tikway.ai/v1 is followed by /chat/completions. Claude Code uses a different base URL; see its setup guide.
Look for /v1/v1/, a complete operation path used as a base URL, the website hostname instead of the API hostname, or proxy path rewrites. Correct one suspect setting at a time and compare results.
5. Separate authentication, balance and rate limits
| Result | Next step |
|---|---|
| 401, invalid or missing credentials | Check key source, headers and route. |
| 403 | Check permissions and access policy using the message. |
429 + insufficient_balance |
Check balance; repeated waiting usually cannot fix it. |
429 + requests_per_minute_exceeded |
Reduce frequency and concurrency. |
| Model or parameter error | Check ID, protocol and parameter ranges in the catalog. |
Do not retry failed authentication indefinitely or repeatedly add funds without checking the cause. See billing and errors.
6. Validate the fix
Use the minimal Python request or Claude Messages request to check HTTP status and meaningful content. Restore streaming, tools and history gradually in the original client, and keep a redacted working baseline.