Upcoming change to API authentication error responses

Starting October 28, 2026, Baseten APIs will return 401 Unauthorized instead of 403 Forbidden when a request has missing, invalid, or expired credentials. This includes requests with invalid API keys or expired authentication tokens.

Before the rollout, update any clients, monitoring, or automation that check for 403 to detect authentication failures. These should handle 401 responses instead.

Requests with valid credentials but insufficient permissions will continue to return 403 Forbidden.

For more information, see our docs.