What does "invalid access token" mean?

The service received an access token it could not accept. The token may have expired, been revoked, been issued for a different service, or been mistyped or cut off when copied. It is usually an HTTP 401, which means the service cannot tell who is calling. Signing in again or creating a new credential is the usual fix; resending the same request is not.

What is the difference between an invalid API key and an invalid access token?

An API key is a long-lived secret you create and paste into a client, and an invalid API key means the service does not recognise it as an active key, for example because it was mistyped, revoked or rotated. An access token is normally issued to an app after you sign in, and it expires, so an invalid access token usually means it expired or the sign-in was revoked. In GetItDone's API a Bearer value starting with gid_ is treated as an API key and any other Bearer value as an access token.

What does "missing credentials" mean?

The request carried no credential at all. Common causes are an Authorization header that was never set, or a proxy, gateway or HTTP library that removed it. In GetItDone's API it means there was no Authorization: Bearer header, because that is the only form the API reads.

Why did a token that worked stop working?

Its lifetime ended, the sign-in or key was revoked or rotated, or the account lost access to the organization or project it belonged to. Work out which credential the client is actually sending, then sign in again or create a new one. GetItDone access tokens last 30 days by default, and revoking an app under Connected Apps takes effect on its next request.

What is the difference between a 401 and a 403 error?

A 401 means the service could not establish who is calling, because the credential is missing, invalid or expired. A 403 means it knows who is calling, but the credential is not allowed to do this, for example because it lacks a scope. The MCP authorization specification uses the same split. In GetItDone's API a missing scope returns 403 with the insufficient_scope code.

2026-10-17

"Invalid access token" or "invalid API key": meaning and fix

If a service just told you "invalid access token" or "invalid API key", the short version is: it received a credential it could not accept. The credential may be missing, mistyped, revoked, expired, or issued for a different account, project or service. These errors usually arrive as HTTP 401, and sending the same request again will not change the outcome; the credential has to change.

Wording varies by product, and this page does not claim which assistant or tool prints a given message. The meanings below come from the vendor and specification pages linked at the end, which were read on 2026-10-17. The page also covers how GetItDone's API and MCP server answer, because both reject credentials they cannot accept.

Invalid access token, invalid API key, missing credentials: what is the difference?

Missing credentials means the request carried no credential at all: the header was never set, or something between the client and the service removed it. Invalid API key means a key was sent, but the service does not recognise it as an active key. It may be mistyped, revoked, rotated, expired, or from a different project or environment. Invalid access token means a token was sent, usually the short-lived kind an OAuth sign-in produces, and the service could not verify it, for example because it expired or the sign-in was revoked. All three tell you the credential is the problem, not the request.

401 or 403: who are you, or what may you do?

A 401 means the service could not establish who is calling, because the credential is absent, invalid or expired. A 403 means it knows who is calling, but that credential is not allowed to do this: a missing permission, scope, project access or region. The fix for a 401 is a working credential. The fix for a 403 is a credential with more access, or a different request. The MCP authorization specification draws the same line: its error table lists 401 as authorization required or token invalid, and 403 as invalid scopes or insufficient permissions.

What the vendors' own documentation says

OpenAI API: the error-code guide lists several 401 entries. "Invalid Authentication" says to make sure the correct API key and requesting organization are being used. "Incorrect API key provided" says the requesting key is not correct, and suggests checking the key, clearing your browser cache, or generating a new one. A third says your account is not part of an organization, which you fix by being added to one. A fourth is for requests from an IP address that is not on the project or organization allowlist. The 403 entry it lists is for accessing the API from an unsupported country, region or territory.

Claude API: the errors page describes a 401 authentication error as an issue with your API key, for example that it is malformed, revoked or expired. A 403 permission error means your API key does not have permission to use the specified resource, and it points you to your organization's access and workspace settings in the Claude Console.

Gemini API: the errors page lists a 401 for an API key that is missing, invalid or expired, and recommends verifying your API key. It lists a 403 for an API key that does not have permission for the resource, and recommends checking the key's permissions and project access.

MCP authorization specification: it says invalid or expired tokens must receive an HTTP 401 response. It says the access token goes in the Authorization header as a Bearer token on every request, and must not be put in the URL query string. For a valid token that lacks a permission, it says the server should answer 403 and name the scopes needed, and that a client should respond by asking for a new token with more scopes. So a 401 from an MCP connector is the case where the token is missing, invalid or expired.

What to do

Check the credential was copied whole. A stray space or newline at either end, or a truncated paste, is enough to make a valid key look invalid. Send it where the service expects it, usually the Authorization header, and not in the URL.

Check it belongs to the service, project and environment you are calling. The OpenAI guide asks you to make sure the key and the requesting organization match. A key from a test project does not work against production, and a key for one provider does not work with another.

Check it has not been revoked, rotated or allowed to expire, and create a new one if needed. The Claude page names revoked and expired keys, the Gemini page names expired ones, and the OpenAI guide suggests generating a new key.

If it is a connector or app you signed in to, the usual fix is to sign in again. An access token has a limited lifetime and can be revoked from the account that issued it, so disconnecting the connector and connecting it again issues a fresh one. If the error is a 403 or names a missing permission, reconnect and approve the broader permissions on the consent screen.

If the error says credentials are missing, look between your client and the service. A proxy, gateway or HTTP library that drops the Authorization header produces this error even when the key is correct.

Why a token that worked stops working

Several ordinary things change a credential's status without you touching your code: the token reached its expiry, the sign-in was revoked in the account that issued it, a key was rotated or deleted, or the account lost access to the organization or project the key belonged to. The OpenAI guide lists the last case as a 401 ("You must be a member of an organization to use the API"). The fix is the same in each: work out which credential the client is actually sending, and replace it.

How GetItDone's API and MCP server answer

GetItDone's REST API (/v1) reads one credential form: an Authorization: Bearer header. Which error you get depends on what that header holds. No Bearer header at all returns 401 with the missing_credentials code. A Bearer value that starts with gid_ but is not an active key (unknown, revoked or expired) returns 401 with invalid_api_key. Any other Bearer value that cannot be verified, such as an expired OAuth access token, returns 401 with invalid_token. A credential that is valid but was not granted the scope an operation needs returns 403 with insufficient_scope, and the response names the scope. Every error is an RFC 9457 problem+json body with a stable code and a request ID to quote when you ask for help. Each code has its own page with causes and fixes:

The MCP endpoint, https://app.nowgetitdone.com/api/mcp, does not separate missing from invalid. A request with no accepted credential, whether that is nothing at all, a revoked gid_ key or a revoked or expired sign-in, gets one answer: HTTP 401 with a JSON-RPC "Unauthorized" error and a WWW-Authenticate header. That header points to the server's protected-resource metadata and lists the scopes derived from the tool catalog, which is what an MCP client uses to start the sign-in. A client that cannot sign in can use a gid_ API key instead, created under Settings, API Keys.

Sign-ins use OAuth 2.1 with PKCE, and access tokens last 30 days by default. Every request checks that the connection is still approved, so revoking an app under Connected Apps in your GetItDone profile takes effect on its next request, and the app then has to sign in again. A tool outside the scopes you approved is never shown to the assistant, so if an assistant cannot do something your account can, disconnect it, connect it again, and approve the permissions it asks for on the consent screen.

Sources

Vendor and specification pages read on 2026-10-17. This page restates them in our own words and may fall behind; the pages below are the authority.

Questions

What does "invalid access token" mean?: The service received an access token it could not accept. The token may have expired, been revoked, been issued for a different service, or been mistyped or cut off when copied. It is usually an HTTP 401, which means the service cannot tell who is calling. Signing in again or creating a new credential is the usual fix; resending the same request is not.
What is the difference between an invalid API key and an invalid access token?: An API key is a long-lived secret you create and paste into a client, and an invalid API key means the service does not recognise it as an active key, for example because it was mistyped, revoked or rotated. An access token is normally issued to an app after you sign in, and it expires, so an invalid access token usually means it expired or the sign-in was revoked. In GetItDone's API a Bearer value starting with gid_ is treated as an API key and any other Bearer value as an access token.
What does "missing credentials" mean?: The request carried no credential at all. Common causes are an Authorization header that was never set, or a proxy, gateway or HTTP library that removed it. In GetItDone's API it means there was no Authorization: Bearer header, because that is the only form the API reads.
Why did a token that worked stop working?: Its lifetime ended, the sign-in or key was revoked or rotated, or the account lost access to the organization or project it belonged to. Work out which credential the client is actually sending, then sign in again or create a new one. GetItDone access tokens last 30 days by default, and revoking an app under Connected Apps takes effect on its next request.
What is the difference between a 401 and a 403 error?: A 401 means the service could not establish who is calling, because the credential is missing, invalid or expired. A 403 means it knows who is calling, but the credential is not allowed to do this, for example because it lacks a scope. The MCP authorization specification uses the same split. In GetItDone's API a missing scope returns 403 with the insufficient_scope code.