# key_invalid

> The key's token is not valid

- Status: 401 Unauthorized
- Returned by: /api/public with an organisation key
- Retry (`retryWhen`): `after_fix`
- Did anything happen? (`outcome`): `none` (It did not happen)
- Access and organisation
- Page in the portal: https://developers.rivr.io/errors/key_invalid
- Try it: `GET https://developers.rivr.io/errors/simulate/key_invalid` answers with the code's exact wire form; `?succeedAfter=N&attempt=K` gives a 200 once `attempt` passes `N`

## What it means

The organisation key's token is not accepted on `/api/public`. Its signature or lifetime is wrong, or the key has been revoked. A token from another issuer, or for an audience other than `https://api.rivr.io`, is not treated as an organisation key. It goes through as usual, and then `/api/public` answers itself instead of with `key_invalid`.

## What your system does

Get a new token with the key's `client_id` and secret and `resource=https://api.rivr.io`. A token lasts about an hour, so cache it and fetch a new one when it expires. If the new token also gets `key_invalid`, the key has been revoked: create a new one on the API keys page.

## Is it worth retrying?

No, not without changing the call.

`retryWhen`: `after_fix`. Change the request first, as the code's page says: a value, the token, a header or a new key. Then send it.

## Did anything happen?

`outcome`: `none`. **It did not happen.** This call did not do what you asked for and changed nothing else that you can see or that concerns money. Where the code has an `outcomeNote`, it takes precedence.

## Example: /api/public with an organisation key

```http
HTTP/1.1 401 Unauthorized
Content-Type: application/problem+json
Rivr-Should-Retry: false

{
  "type": "https://developers.rivr.io/errors/key_invalid",
  "title": "The organization API key's token is not valid.",
  "status": 401,
  "code": "key_invalid",
  "detail": "The organization API key's token is not valid.",
  "instance": "/api/public/orders/7b1e7c3a-2f4d-4a51-9c7e-5d0a6b8e2c14/status",
  "requestId": "5f0c2a7e-9b41-4d3a-8e6f-1c2d3b4a5e6f",
  "retryWhen": "after_fix"
}
```

The `title`, `detail`, `message` and `error_description` texts are exactly as the API writes them today.