> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kash.bot/llms.txt
> Use this file to discover all available pages before exploring further.

# API_KEY_MALFORMED

> HTTP 401 — Authentication required

**HTTP status:** 401 · **Title:** "Authentication required"

## When it fires

The `X-API-Key` header is present but does not match the expected `kash_(live|test)_<32 alphanumeric>` shape.

## Why it happens

* Leading or trailing whitespace, for example a trailing newline from a copy-paste.
* The wrong environment variable was substituted, such as a session token or a bare UUID instead of a Kash API key.
* A logging or proxy layer truncated the header value.

## How to fix

* The format is `kash_<env>_<32 alphanumeric>`: base62 (`A-Z`, `a-z`, `0-9`), with no dashes or underscores after the prefix. The `<env>` segment is `live` or `test`.
* `live` keys work against production (`https://api.kash.bot/v1`); `test` keys work against staging (`https://api-staging.kash.bot/v1`). Don't mix them.
* If the key comes from an environment variable, check the substitution: `echo $KASH_API_KEY | head -c 16` should print `kash_live_…` or `kash_test_…`.

## Related codes

* [`API_KEY_MISSING`](https://docs.kash.bot/developer-docs/api-errors/API_KEY_MISSING) — no header at all
* [`API_KEY_INVALID`](https://docs.kash.bot/developer-docs/api-errors/API_KEY_INVALID) — well formed but unknown


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.