Error: api_key_required
The request hit a route that requires authentication, and no valid Authorization header was sent.
What it means
Control-plane routes (rules, agents, approvals, dashboard data) require a valid key or admin token.
Unlike the evaluate endpoint, these routes never run anonymously.
Common causes
Calling /api/rules or /api/approvals without an Authorization header.
A client that only learned the evaluate endpoint pattern and reused it unchanged.
An admin-only route called with a regular agent key.
How to fix
Attach a valid key: Authorization: Bearer <key>.
Use the admin token (self-host, from the .admin_token file or env) for operator routes.
At a glance
| Field | Value |
|---|---|
| HTTP status | 401 |
| Error code | api_key_required |
| Response shape | {"error": "api_key_required"} |
| Affected routes | /api/rules, /api/agents, /api/approvals, dashboard |
Example
curl -X GET https://sipi.bot/api/rules
HTTP/1.1 401
{"error": "api_key_required"}
# Fix:
curl -X GET https://sipi.bot/api/rules -H "Authorization: Bearer <valid-key>"Add the header; the route returns your rules.
FAQ
Which routes require a key?
Control-plane routes: rules management, agent keys, approval resolution, and dashboard endpoints. Evaluate stays anonymous-capable.
What's the difference from invalid_api_key?
api_key_required means no key was sent to a protected route. invalid_api_key means a key was sent but is not valid.
Can I self-host without keys?
You still need the admin token for operator routes; the evaluate endpoint can run anonymously.
Related
Stop the next $12,400 night.
One API call (or MCP tool) in front of every agent transaction — APPROVED, BLOCKED, or FLAGGED, deterministic, ~5 ms, fully logged.
See plans — from $99/mo Try a live check