How should I handle 401 and 403 errors?

For 401, check the key and authentication header first; for 403, also check permissions, model access, IP whitelist or blacklist, key expiry, and rolling spend limit.

Steps

1. Confirm the required Bearer, x-api-key, or x-goog-api-key header.
2. Check key status, expiry, IP rules, and access to the target model.
3. Record the request ID and retry from a whitelisted network.

Limits and exceptions

Do not retry 401 or 403 indefinitely; revoke a leaked credential instead of only changing the client.