unauthorized

HTTP 401 · not retryable

The X-Api-Key header is missing, doesn't start with mk_live_, doesn't decode to key_id.secret, or names a key that's been revoked or expired. Plugin endpoints also reject keys not bound to a plugin_installations row.

How to fix

• Verify the header name is exactly X-Api-Key.
• Confirm the key value starts with mk_live_ and was issued via the plugin installations flow (regular API keys cannot reach plugin endpoints).
• Check that the installation hasn't been suspended or uninstalled.
• Re-issue the key from the merchant settings UI if it was revoked.