Bunny.net purge API 401 Unauthorized in CI

By Kaveh Alemi·Latchkey

Bunny.net rejected the purge key: a 401 Unauthorized means the AccessKey header is missing, wrong, or the wrong scope. The account API key authorizes account endpoints like purge; a pull-zone key does not.

What this error means

A GET/POST to the Bunny purge endpoint returns HTTP 401 Unauthorized with an empty or short body. The URL is correct but the key is not accepted.

HTTP/1.1 401 Unauthorized
# request: POST https://api.bunny.net/purge?url=https://cdn.example.com/app.js
# header sent: AccessKey: <missing or wrong key>

Common causes

The AccessKey secret is missing or wrong

The AccessKey header is built from a secret that was never set or is incorrect, so Bunny returns 401.

A pull-zone key used for an account endpoint

The account-level purge endpoint needs the account API key; a storage-zone or pull-zone key does not authorize it.

How to fix it

Send the account API key in AccessKey

1. Copy the account API key from the Bunny dashboard.
2. Store it as a secret.
3. Send it in the AccessKey header on the purge request.

curl -sS -X POST \
  "https://api.bunny.net/purge?url=https://cdn.example.com/app.js" \
  -H "AccessKey: ${BUNNY_API_KEY}" \
  -H "Accept: application/json"

Confirm the key with a read call

List pull zones to confirm the key authenticates before purging.

curl -sS "https://api.bunny.net/pullzone" -H "AccessKey: ${BUNNY_API_KEY}"

How to prevent it

• Use the account API key for account endpoints like purge.
• Keep the key in CI secrets and rotate in one place.
• Verify the key with a read call before the purge step.

Frequently asked questions

Related guides

References

• .NET documentation
• GitHub Actions documentation