Use the error code to locate the header at fault. As a rule of thumb, a 401 means a header is missing, malformed, expired, or wrongly built, while a subscription/permission error means your headers were accepted but the account isn't entitled to the operation.
| Error | Header | Likely cause & fix |
|---|---|---|
401 Unauthorized - ApiKeyInvalid | x-api-key | Missing or wrong key. Each API version and environment have their own key. |
401 — "Authorization header is missing" | Authorization | No bearer token sent. Add Authorization: Bearer <token>. |
401 — token invalid / expired | Authorization | Bad signature, wrong audience, or expired token. Re-acquire the token. Note that tokens expiring within ~2 minutes are rejected proactively — refresh ahead of expiry. |
401 — "Invalid google audience claim" | Authorization | The Google token's audience doesn't match what Doctavian expects. Check the client/app you minted the token with. |
400 X_CLIENT_AUTH_ERROR — "header is missing for async operations" | x-client-authorization | You called an async endpoint without the client header. Build and send it. |
400 X_CLIENT_AUTH_ERROR — "Invalid format" | x-client-authorization | Same decryption failure as above — rebuild the header. |
401 (client token) | x-client-authorization | Unsigned/wrongly-signed or expired JWT. |
400 X_CLIENT_AUTH_ERROR — "missing claims" | x-client-authorization | sub, iss, or dest is empty. Provide all three. |
Subscription error / NO_DEFAULT_SUBSCRIPTION | Subscription | Your headers were accepted, but no active/usable subscription was found for this account. |
AUTHORIZATION_ERROR | Identity | Your identity or a required claim couldn't be resolved. Verify the identity in Authorization. |
ApiKeyInvalid? → It's the x-api-key. Wrong API area is the usual culprit.401 with no custom-header code? → It's the Authorization token. Re-acquire it.X_CLIENT_AUTH_ERROR? → It's x-client-authorization on an async call. Check presence, crypto, and the sub/iss/dest claims.Still stuck? Capture the exact status code and error body and compare it against the table above before reaching out — it almost always points straight at the offending header.