API keys and common errors

Two types of keys

• Application keys authenticate an app or service. They’re attached to an Application in TrustGate.

• Personal keys identify an individual person.

The two types aren’t interchangeable. Using the wrong one is the most common cause of authentication errors. See Authentication and Applications.

If you get a 401

A key that’s unknown, revoked or expired is refused in exactly the same way, so check all three:

1. The key is copied exactly, with no extra spaces, and sent in the expected header.

2. The key hasn’t been revoked and hasn’t passed its expiry date.

3. The key is attached to an Application on the right plane: LLM for model calls, MCP for tools.

Other cases

• 421 on Hybrid: you’re sending a data-plane key to the cloud. Point TRUSTGATE_URL at your own data plane.

• Key leaked? Revoke it immediately, issue a new one, then open a Security request.

Full error reference: SDK errors.