401 Unauthorized from the render API

What is actually happening

The key that arrived is not the key you think you sent. The usual causes are dull and specific: a trailing newline from a file or a secret manager, the word Bearer missing or doubled, or a different environment holding a different value.

Confirming it is this and not something that looks like it

Log the length of the key and its last four characters, never the key itself. Length settles the whitespace question immediately, and the last four settle which key it is.

The fix

Strip whitespace when reading the key, and check the header format. A secret written to a file by an editor picks up a trailing newline, which most HTTP clients will send verbatim.

const key = (process.env.PDFPIPE_KEY ?? "").trim();

if (!key) {
  throw new Error("PDFPIPE_KEY is not set in this environment");
}

// Never the key itself, in any log, at any level.
console.log(`using key ending ${key.slice(-4)}, length ${key.length}`);

const headers = { Authorization: `Bearer ${key}` };

If that was not it

These produce the same symptom often enough to be worth ruling out before assuming the fix above did not work.

• A trailing newline from a file-based secret or a here-doc
• Bearer included in the stored value and prepended again in code
• A test key used against production, or the reverse
• A revoked or rotated key still cached in a build image

Frequently asked

Related failures

Problems people arrive at from the same starting point, or mistake for this one.