"Incorrect API key", "insufficient_quota", and other refusals

A refusal is one of two events, and the first words say which.

The first words	What happened
[<Vendor> issue]:	the AI service answered and said no - its own words follow
Missing <Vendor> API Key	no credential reached the request, so Big-AGI refused before calling the service

[OpenAI issue] Unauthorized: Incorrect API key.

The AI service rejected the credential. Big-AGI rewrites any upstream text containing Incorrect API key into this exact sentence, so it names OpenAI whichever OpenAI-compatible service produced it.

1. Open Models (Ctrl + Shift + M) -> Advanced and re-paste the key, checking for a truncated copy or a trailing space.
2. Press Models. A model count coming back means the key is accepted.
3. Still refused: issue a fresh key and delete the old one (rotating and revoking). A key that is valid but not permitted shows as 403 Forbidden instead.

Upstream responded with HTTP 401 Unauthorized

The AI service received the key and refused it. Its own explanation follows the colon, kept up to 480 characters so org ids and help URLs survive intact.

1. Read the quoted part - it names the reason: revoked, wrong project, wrong header. A key that works in another tool and fails here differs in one of those three.
2. Confirm the key still exists in the service's console. A key deleted there still looks correct here, because the field checks length and never liveness.
3. Re-paste and press Models. If the field reads Already set on server, the key comes from the deployment and only its operator can change it (keys and access control).

Upstream responded with HTTP 403 Forbidden

The AI service accepted the credential and refused this action - a project without access to that model, a region restriction, or a key restricted to certain callers. Big-AGI appends Please make sure the Server can access -> <url> to 403s as well as 404s. On a 403 it misleads: the request did arrive.

Gemini, on a payload containing "Requests from referer", adds:
  Gemini: Check API key restrictions in Google Cloud Console

1. Read the quoted text from the service; permission failures name what they refused.
2. For that Gemini line, remove the HTTP-referrer restriction on the key, or issue an unrestricted one.
3. Confirm the model is enabled for the key's own project. Text mentioning tokens per minute is the model-access case below.

Missing <Vendor> API Key

Every vendor's version of the string names the two places a key can come from: the UI, or the environment of the deployment.

1. Paste the key in the Models panel (add and manage your keys).
2. On an instance you run, set the variable and restart; a field reading Already set on server confirms the server holds one. If it is set and still missing, the variable may never have reached the process.
3. Missing OpenAI API Key on a service you pointed elsewhere means the host field is wrong. That guard fires only against OpenAI's own host, because a custom OpenAI-compatible host needs no key.

An error occurred. Please check your API Key.

The setup panel's fallback when the AI service returned nothing usable to quote.

What the panel says	When
An error occurred. Please check your API Key.	the default
An error occurred. Please check your server.	the three local runtimes - that field is an address

1. Re-paste the key and press Models. The failed fetch also emptied that service's model list, so the empty list is the same event.
2. For a local runtime, the address and which side calls it matter more than the key (my local models don't show up).

I have credit and it still says quota

Rate limit and quota arrive as the same HTTP 429, and Big-AGI splits them. Rate limit means too fast - wait. Quota, balance or billing means out of money or out of allowance - act. The split is exact:

The 429 text contains	What it is	Retried
quota or billing	Out of money or out of allowance	Never
request too large, or limit <n>, requested <n>	One request over the per-minute token limit	Never
rate limit of 0 input tokens per minute	No access to that model	Never
Insufficient balance or no resource package	A prepaid balance at zero	Never
credit balance is exhausted	Prepaid credit gone	Never
anything else	A real rate limit	4 attempts, roughly 1s, 2s and 4s apart

1. Top up or raise the limit: OpenAI limits and usage, Anthropic limits, OpenRouter credits.
2. A spend limit you set yourself comes back from OpenAI as a 429 with insufficient_quota. It stays until you raise it, or until the month rolls over.
3. A paid chat subscription is not API credit - separate balances at the same company (chat subscriptions and API access).

429 Too Many Requests

A genuine rate limit: the AI service is throttling how fast you send, not what you owe. Big-AGI already made its four attempts before showing it, so the burst has passed.

1. Wait and resend. A rate limit clears by itself, and a free tier that stops part-way through a session has hit speed, not spending.
2. Parallel models multiply the rate: one Beam with five cards is five simultaneous calls. A single limit then takes several down at once (run several models at once).
3. A new account starts in the service's lowest tier, and tiers rise with spend and account age. Groq publishes yours at console.groq.com/settings/limits.

A request refused before generation bills nothing; a stream that stopped part-way bills what it produced.

rate limit of 0 input tokens per minute

Your organisation has no access to that model. It is shaped like a rate limit - a limit of zero - and nothing on the Big-AGI side raises it.

1. Choose another model from the same AI service (add and manage your keys).
2. Request access where the model sits behind a preview or an approval, using the key's own organisation.

There is no workaround here: the grant has to come from the AI service.

Direct Connection is on and every request fails

The toggle is Big-AGI's; the permission is the AI service's. With it on, your browser calls the service itself. A service that does not allow browser calls refuses before the model is ever reached.

1. Turn Direct Connection off for that service. Its description returns to Via server (default) and the same key works through the Big-AGI server.
2. It is off by default for every cloud vendor, and where the row is absent that service is server-only.
3. Cerebras is the inversion: it ships on, because its edge serves the Big-AGI server a bot-challenge page while a browser passes cleanly. For a local runtime, on is likewise the recommendation (my local models don't show up).

None of these match

Sync not available, Storage quota exceeded. Please upgrade your plan or free up space. and Unknown feature status read like access errors and come from your Big-AGI plan (plans and billing). Sign-in refusals belong to your account and Pro. Anything else: where to send it.

Related

• Add and manage your keys
• Keep your key safe
• Fix a problem