Home›Error Fixes

401 Authentication Failed

Fix 401 authentication failed by checking the API key, provider Base URL and environment credential, then testing model discovery separately from chat.

On this page

First, match 401 authentication failed

This page targets 401 authentication failed. The full message can contain a few extra words on different operating systems or Node.js versions, but the core error code or phrase should match.

401 authentication failed

401 Unauthorized

authentication failed 401

DSH 401 error

401 / authentication failed

When searching or asking for help, copy the full error and remove API keys, private repository names, usernames and sensitive paths.

Fast fix: 401 authentication failed

A 401 means the remote provider rejected authentication for this request. Re-enter the correct key, check the provider Base URL, and restart DSH if the credential comes from an environment variable. If only Fetch Models fails, test chat separately.

What 401 authentication failed means

The remote service rejected the request's authentication. This does not prove that the key alone is the problem: the endpoint, account details or authentication method may also be wrong.

Common causes of 401 authentication failed

The key is invalid, expired, revoked or copied with extra spaces.
The key belongs to a different provider or Base URL.
DSH started before the apiKeyEnv value was set or changed.
The provider requires additional native authentication, such as project, region or OAuth details.
A custom gateway authenticates GET /models differently from its chat endpoint.

Source trace for 401 authentication failed

These links are pinned to the 0.1.2-alpha.5 / 49a606b snapshot used for this page. They help separate 401 authentication failed from failures produced by Node.js, PowerShell, the operating-system network stack or filesystem permissions.

Provider troubleshootingThe official guide separates a 401 from general chat failure: model discovery calls GET /models, so a gateway can fail discovery even when a manually configured model remains testable.

Fix 401 authentication failed

01
Enter the key again
Copy the key from the provider console, replace the saved credential and remove any leading or trailing spaces.
02
Check the Base URL
Make sure the key belongs to the configured endpoint. A DeepSeek key cannot authenticate against an unrelated OpenAI-compatible gateway.
03
Restart when apiKeyEnv is used
If the provider reads a credential from apiKeyEnv, set the variable first and start DSH again from that same terminal.
04
Separate Fetch Models from chat
If chat works but Fetch Models returns 401, add a verified Model ID manually and investigate the gateway's GET /models authentication separately.
05
Check provider-specific requirements
Bedrock, Vertex, Azure, Codex and other native providers may require more than a simple API-key field. Confirm the provider's own required credentials.

Verify 401 authentication failed is fixed

The provider completes a small text request.
Model discovery succeeds, or a verified manual Model ID works even when discovery is unavailable.

What to avoid

Do not publish the key while asking for help.
Do not disable TLS certificate checks to hide an authentication error.
Do not keep changing unrelated workspace or port settings.