# unauthorized

> Noptcha API error unauthorized (HTTP 401): what it means and what to do.

Source: https://noptcha.com/docs/errors/unauthorized/

HTTP **401**, `application/problem+json`. When: invalid, revoked or expired key.

## What to do

The key is malformed, unknown, revoked or expired. Send it as `Authorization: Bearer nop_live_…` (or `nop_test_…`). After 50 invalid keys from one IP address within 10 minutes, that address is blocked for the rest of the window (`rate_limited`) for keys we do not already know.

See all codes on [Errors](https://noptcha.com/docs/errors.md). Include the `request_id` when you contact support.