A 401 During Friday’s Model Relay Cutover

The 401 we saw during Friday’s cutover

Our deployment reached the API relay, but the request stopped with a 401 Unauthorized response. That message sounds broader than it is. In most cases, the server is saying, “I received your request, but I cannot verify who is sending it.”

A 401 is usually an authentication problem. It is different from a network failure, an invalid model name, or a server outage. The request may be perfectly well formed, but the relay cannot accept the credential attached to it.

What the relay checks before it runs a model

When your application calls an AI model, the request normally includes an API key in an Authorization header. The common form is: Authorization: Bearer your_api_key. The relay checks whether the key exists, is active, belongs to a valid account, and is being sent in the expected format.

RelayVano uses the API base https://api.relayvano.com. A 401 can appear when the base URL is correct but the key is missing, when the key has been copied with an extra space, or when a local environment variable is empty.

The four checks that found our missing credential

• Check the environment variable name. Your shell may contain RELAYVANO_API_KEY, while the SDK is reading OPENAI_API_KEY, or the other way around.
• Check that the variable is available to the running process. A key exported in one terminal is not automatically available inside a different terminal, container, IDE, or CI job.
• Check the header format. The value should be the key itself when the library adds Bearer automatically. Adding Bearer twice can produce an invalid credential.
• Check the key in the RelayVano account dashboard. If it was revoked, rotated, or pasted incompletely, generate or copy the current key again.

Testing the credential without changing your application

Use a small request from the same environment as your application. For an OpenAI-compatible client, point the base URL at https://api.relayvano.com and send the key through the client’s normal authentication setting. A command-line test can also send an Authorization header directly.

Keep the test minimal: use a valid model name, a short input, and a low-cost request. For example, testing a model such as Claude Sonnet 5.5 can tell you whether authentication works before you investigate application logic. Do not paste the full key into source control, chat, screenshots, or issue trackers.

Reading the response body instead of only the status line

The status code is only the first clue. Read the JSON response body and the request ID if one is returned. Messages such as “missing API key,” “invalid API key,” and “authentication failed” point toward different checks, even though they may all use 401.

Also confirm which service produced the response. A reverse proxy, SDK, company gateway, or upstream model provider can return its own 401 before RelayVano receives the request. Logging the response headers and request URL, while masking secrets, helps identify that boundary.

Fixing configuration in common clients

For Claude Code, Codex, Gemini CLI, or an OpenAI-compatible SDK, verify both settings that are easy to confuse: the API key and the base URL. The key must belong to RelayVano, and the base URL must be https://api.relayvano.com rather than the default endpoint installed by the client.

After changing environment variables, restart the command or process. Long-running shells, editor extensions, Docker containers, and CI runners often retain the old environment until they are restarted.

When the error is not really a 401 problem

If the credential is accepted but the request fails later, you may see a different status. A 400 often indicates malformed request data or an unsupported model. A 404 can indicate a wrong route or model identifier. A 429 usually means rate limiting or insufficient available capacity. Treat those responses separately instead of repeatedly replacing a valid key.

A practical relay for the next deployment

RelayVano is a pay-as-you-go relay for AI models, with support for Claude Code, Codex, Gemini CLI, and OpenAI-compatible SDKs. It is a practical choice when one API base needs to serve models across providers without adding a separate integration for each one. Members can also earn 16% when invited users pay.

Once the key, base URL, and client configuration are verified, sign up for RelayVano, run one small authenticated request, and then add the same settings to your staging environment before the production cutover.