401 Unauthorized

The gateway couldn’t authenticate your request. The code field in the error body identifies the exact cause.

Error codes

`invalid_api_key`


{
  "error": {
    "code": "invalid_api_key",
    "message": "Invalid or missing API key. Pass your cm_sk_... key via the X-CM-API-Key header or as the Authorization Bearer token.",
    "request_id": "req_01hwz3kj4p5qm8n9v2t6y7"
  }
}

Causes:

The X-CM-API-Key header is absent
The key value doesn’t start with cm_sk_
A typo introduced spaces or truncated characters

Fix:

curl


# Wrong — missing header
curl https://api.curate-me.ai/v1/openai/chat/completions \
  -H "Content-Type: application/json" \
  -d '{...}'
 
# Correct
curl https://api.curate-me.ai/v1/openai/chat/completions \
  -H "X-CM-API-Key: cm_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{...}'

Python


# Wrong — passing the key as Authorization Bearer
from openai import OpenAI
client = OpenAI(api_key="cm_sk_xxx")  # OpenAI SDK sends as Bearer — does NOT work
 
# Correct — pass as default header
client = OpenAI(
    base_url="https://api.curate-me.ai/v1/openai",
    api_key="cm_sk_xxx",  # SDK sets Authorization: Bearer cm_sk_xxx
    # The gateway also accepts Authorization: Bearer cm_sk_xxx
)
 
# Or use the Curate-Me SDK which handles this automatically
from curate_me.gateway import CurateGateway
gw = CurateGateway(api_key="cm_sk_xxx")
client = gw.openai()

TypeScript


import OpenAI from 'openai';
 
// Both forms are accepted by the CM gateway:
 
// Form 1: X-CM-API-Key header (preferred)
const client1 = new OpenAI({
  baseURL: 'https://api.curate-me.ai/v1/openai',
  apiKey: 'none',  // placeholder; CM key is in header
  defaultHeaders: { 'X-CM-API-Key': process.env.CM_API_KEY },
});
 
// Form 2: apiKey param → sent as Authorization: Bearer (also accepted)
const client2 = new OpenAI({
  baseURL: 'https://api.curate-me.ai/v1/openai',
  apiKey: process.env.CM_API_KEY,
});

Verify your key exists:


curl https://api.curate-me.ai/v1/admin/me \
  -H "X-CM-API-Key: cm_sk_your_key_here"
# Returns 200 with org info if the key is valid

`api_key_revoked`


{
  "error": {
    "code": "api_key_revoked",
    "message": "API key has been revoked. Generate a new key in Settings → API Keys.",
    "request_id": "req_01hwz3kj4p5qm8n9v2t6y8"
  }
}

Fix: Generate a new key at Dashboard → Settings → API Keys → New Key. Revoked keys cannot be reinstated.

`org_suspended`


{
  "error": {
    "code": "org_suspended",
    "message": "Your organization has been suspended. Contact support@curate-me.ai.",
    "request_id": "req_01hwz3kj4p5qm8n9v2t6y9"
  }
}

Fix: Contact support@curate-me.ai with your organization ID. Suspensions are triggered by unpaid invoices or abuse flags.

`trial_token_expired`


{
  "error": {
    "code": "trial_token_expired",
    "message": "Your trial API key has expired. Add a payment method to continue.",
    "request_id": "req_01hwz3kj4p5qm8n9v2t6ya"
  }
}

Fix: Go to Dashboard → Settings → Billing and add a payment method to upgrade from trial.

Diagnosing auth failures


# Check key validity and org status
curl -s https://api.curate-me.ai/v1/admin/me \
  -H "X-CM-API-Key: cm_sk_your_key" | jq .
 
# Expected success response:
# { "org_id": "org_xxx", "plan": "starter", "status": "active" }

If you’re rotating keys, create the new key first, update your apps, then revoke the old key. Never revoke before updating.