> AffiliateOS Help Center. Index of every article for AI tools: https://www.affiliateos.ai/help/llms.txt

# Why an API key stopped working

Account, team and security · For publishers, networks · Updated 30 October 2026
Web version: https://www.affiliateos.ai/help/account/api-key-stopped-working

Most often the key expired or was revoked. Both answer HTTP 401 with `Invalid or expired API key`. Open your key list (publishers: **My Profile**, then **API Keys**; networks: **Workspace settings**, then **API Keys**) and check the key is still there and its **Expires** date hasn't passed.

| What you see | What it means | What to do |
|---|---|---|
| 401 `Invalid or expired API key` | The key expired, was revoked, has a typo or belongs to another portal | Work through the checks below |
| 401 `Missing x-api-key header` | A network call arrived without the header | Send the key in `x-api-key` |
| 401 `Partner account is not active` | Your publisher account is restricted | [Contact support](https://www.affiliateos.ai/contact?topic=support) |
| 403 `Your account is currently restricted. Please contact support.` | Your network account is restricted | [Contact support](https://www.affiliateos.ai/contact?topic=support) |
| 403 `Your account is pending approval. Please wait for activation.` | Your network account isn't active yet | Wait for our team, or ask us |
| An empty offer screen and no error in your logs | Your code may be treating the 401 as an empty list | Log the status code of every call |

## Checks, most likely first

### The key expired

**How to confirm:** find the key's prefix in your list and read **Expires**. Network keys expire, 90 days after they were generated by default. On publisher accounts, only older keys carry a date; keys made now show Never.

On a network list the badge can still read active after the **Expires** date. The date decides, not the badge.

**Fix:** generate a new key and deploy it: [Create, rotate and revoke API keys](https://www.affiliateos.ai/help/account/create-rotate-revoke-api-keys). On a network account an expired key still counts toward your key limit, so choose **Remove** on it first if **Generate Key** says the limit is reached. Put the next expiry date in your calendar.

### The key was revoked

**How to confirm:** the key's prefix is missing from the list. Revoked keys are deleted, not marked. On a publisher account any Owner or Admin can revoke keys, so ask your team.

**Fix:** generate a new key and deploy it.

### The key belongs to another portal

**How to confirm:** look at the start of the key. Publisher keys start with `pk_` and work on `/publisher/**` (and the older `/partner/**`). Network keys start with `ak_` and work on `/network-api/**`. Advertiser keys also start with `ak_`, but they're for sending events, not reading offers.

**Fix:** use the key made in the portal you're calling. The [hosts and keys table](https://www.affiliateos.ai/help/developers#keys) lists which key goes where.

### The header or the value is off

**How to confirm:** log the exact request your server sends. The key goes in a header named `x-api-key`, never in the URL. A space or line break copied in from an environment file makes it a different key.

**Fix:** trim the value where your server reads it, and send it only in `x-api-key`.

### Your account isn't active

**How to confirm:** the response is `Partner account is not active` (publishers) or a 403 that names your account (networks). Publishers see their account **Status** on **My Profile**; for networks, the 403 message names it.

**Fix:** [Contact support](https://www.affiliateos.ai/contact?topic=support). Keys start working again once the account is active; you don't need new ones.

## Send us this

- The email you sign in with, and your account type: publisher or network
- The key's prefix as your key list shows it, never the full key
- The URL you called and the full response body
- The time of a failed call, with your time zone
- When the key last worked, if you know