Missing, invalid or expired API credentials

What it means#

Every call to the merchant API (/api/v1) or the company API (/api/company/v1) is checked in a fixed order: the key, then the account, then the plan. The first check that fails stops the call and returns the standard error envelope with an error.code. Nothing is created or charged. This page maps each answer to its cause and fix.

Who is affected#

Merchants using the merchant API key, and company admins using the company API key. API keys have no expiry date, so a "key expired" situation is really a key that was renewed or revoked, or a plan or subscription that ended.

Likely causes#

Add Accept-Language: en to get the English messages below; the default is Arabic.

A 429 with rate_limited is a plan limit, not a credentials problem; see the rate limit article. A common pitfall: a key with a stray quote, space inside, or masked characters is simply a different key, so it gives invalid_key. Spaces at the start or end are ignored.

How to diagnose#

Call the account endpoint and read the HTTP status and error.code:

curl -i https://YOUR_DOMAIN/api/v1/me \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Accept-Language: en"

Use /api/company/v1/me for a company key. Then compare with the panel:

• Merchant: open Webhook and API under Integration. The first row, labelled «API للمطورين» (Arabic text meaning developer API, shown even in the English interface), lists the key masked with its first 7 and last 4 characters; the eye button shows it in full. No key means none exists.
• Company admin: open Integrations and API. The API key card shows the key (first 8 and last 4 characters when masked). The Company plan card shows the plan, its end date and which features are included, and a warning appears above the key if the plan has no API.
• Prefix: merchant keys start with sk_ and company keys with ck_.

Resolution steps#

1. Fix a missing or invalid key

   Send Authorization: Bearer YOUR_API_KEY exactly, with the right key for the right API. Compare your stored key with the panel. If it differs, or you are unsure, renew it.

2. Renew or generate the key

   Merchants press Generate, or Renew when a key exists, in the «API للمطورين» row. Company admins press Generate API key, or Renew. Renew asks for confirmation, and the page then shows the new key in full. The old key stops working immediately, so update every system that uses it. Key generation is limited to 20 requests per minute for merchants and 10 for companies; if you exceed that, wait a minute and try again.

3. Fix account or plan answers

   For plan_feature, merchants open Plan and subscription to renew or upgrade; company admins renew the company subscription (subscription_expired) or ask the platform to add the API feature to the plan. For api_not_allowed, a merchant of a delivery company cannot use the merchant API: parcels go through the company, which may use the Company API for its merchants. For account_inactive, the account must be reactivated by whoever manages it.

4. Test again

   Call GET /me again. A 200 with "success": true confirms the key and the plan; the same key works again once an expired plan is fixed.

1234

1. Your current API keys (shown masked)
2. The name of the platform or system you connect
3. Generate a new key
4. Open the API documentation

Common mistakes#

• Using the wrong key type: a ck_ key on /api/v1, or a Store Syria, WooCommerce, Salla or custom-platform key, gives invalid_key.
• Forgetting to update your system after Renew.
• Copying the masked text from the table. The dots are part of it.
• Expecting Invalid Api Key. That HTTP 400 message belongs to the mobile apps API and its apiKey header; these APIs never use it.

When to contact support#

• account_inactive and you believe the account is active: ask your delivery company or the platform.
• The company page says "The company has no owner admin — contact support." when you try to generate a key.
• A 500 server_error: quote the reference (it starts with E).