# X_API_KEY_INVALID

## Means

key unknown, revoked, expired, wrong, or owned by a user who is gone or disabled

## Typical cause

one shape for all of them — a precise message is an enumeration oracle, so which it was is not named here and never will be. The wiki used to name `x auth keys list --json`, a command that has never existed

## Fix

issue a replacement: `const { plaintext, record } = issueApiKey({ env, scopes }); await auth.adapter.putApiKey(record)` — `auth.adapter.listApiKeys(ownerId)` through `describeApiKey()` shows which keys are still live

[Auth and sessions](/error-codes#auth-and-sessions)