AUTH_KEY_IN_BROWSER

A live API key was sent from a web page. Live keys only work from a server.

HTTP status: 403. Retrying the same request returns the same error.

What to do

Make the request from your server (an API route, or a serverless or edge function) with the key kept as a secret, then rotate the key in the dashboard. Code in the browser never needs a key: to connect accounts, your server creates a connect session and the page uses its token.

Hint returned with the error: Move this request to your server and keep the key in a server secret. Rotate the key, since anyone who opened the page could read it.

Why it happens

• The key is in front-end code, so every visitor to the page can read it
• An AI app builder put the API call in the browser instead of a server function

Related errors

• AUTH_INVALID_KEY
• AUTH_INVALID_CONNECT_SESSION