Troubleshoot Credentials
401 invalid_client, browser vs server keys, sandbox/production mix, Bearer format.
On this page
Publishable keys are browser-safe. Secret credentials are server-only. Partner Bearer format is clientId:clientSecret.
401 calling Partner 2FA
Symptom
Partner endpoints return HTTP 401.
Most likely causes
- Bad Bearer format
- Sandbox/prod mix
- Secret missing clientId prefix
How to diagnose
- Confirm error code invalid_client.
- Confirm no publishable-only auth on secret routes.
How to fix
- Fix credentials.
- See credentials troubleshooting.
Related errors: invalid_client
Related SDK: createKeyraPartner2FA()
Related API: POST /v1/identities/status
Related guides: Credentials
Using client secret in the browser
Symptom
Secret credentials appear in frontend bundles or Web SDK config.
Most likely causes
- Copied server SDK patterns into React
- Env vars prefixed for client exposure
How to diagnose
- Web SDK must use publishable client id only.
- Partner 2FA secret APIs are server-only.
How to fix
- Move secrets to server env / secret manager.
- Rotate exposed secrets.
Related errors: invalid_client
Related SDK: createKeyraAuth(), createKeyraPartner2FA()
Related guides: Credentials, Production