View as MarkdownOpen in ClaudeOpen in ChatGPT

Error codes · Keys and signatures

Invalid credentials

Codeinvalid_credentials
Status401
If this was an orderBought nothing — an earlier copy may have: resume the same id
Send it again unchanged?No — change something first
.NET SDKInvalidCredentialsException

An earlier copy of this order may have gone through

This request bought nothing, but it was refused before Anis looked at the order, so it says nothing about an earlier attempt with the same operation id. Fix the cause first (restore access, or fix how the request is signed), then resume the same id (or read it with GET /orders/{operationId}). Never place it again under a new id.

What it means

Anis could not authenticate the call: the key id is unknown; the key is not active (not yet confirmed, revoked or past its end date), or it is a replaced key whose overlap has ended; the signature does not match the request; or the signature is too old or signed on a clock that is out. All of these get this same answer on purpose, so a refusal never tells anyone which one to work around. A badly built signed request is answered malformed_signed_request instead.

What to do

  • Check that the key id and the private key you sign with belong together.
  • Check that the key is active: the enrolment status reports active once Anis staff confirm it, and keyExpiresAt is the date it stops working.
  • Check your server clock, and sign each attempt afresh — never reuse an old signature.
  • After a key replacement (both keys work for up to 30 days, counted from when the new key starts working): when the overlap ends, the old key is refused as invalid_credentials by itself — nobody needs to do anything. Move your signer to the new key id before then.
  • Run the signature self-check: it reports exactly what Anis saw. If it is refused too, check the key and its state, your clock, and the address you call — it must be the one Anis gave you.
  • On an order: refused before Anis looked at the order, so it says nothing about an earlier attempt with the same operation id. Restore access first, then resume the same id (or read it with GET /orders/{operationId}). Never place it again under a new id.

Where you can meet it

Example

The body of the refusal. Its type is the address of this page.

{
  "type": "https://developers.anis.ly/errors/invalid-credentials",
  "title": "Invalid credentials",
  "status": 401,
  "code": "invalid_credentials",
  "requestId": "01J9R2K8T4V6XQ0M3B7C5D9E1F"
}