Fastly purge 401 "Provided credentials are missing or invalid" in CI

By Kaveh Alemi·Latchkey

Fastly rejected the purge credentials: a 401 with "Provided credentials are missing or invalid" means the Fastly-Key header was not sent, is expired, or the token lacks purge permission. The service is reachable; the auth fails.

What this error means

A purge request (single URL, surrogate key, or purge-all) returns HTTP 401 with a JSON message "Provided credentials are missing or invalid". Anonymous purge attempts fail the same way.

{
  "msg": "Provided credentials are missing or invalid",
  "detail": "Please provide a valid Fastly-Key header"
}

Common causes

The Fastly-Key secret is missing in CI

The Fastly-Key header is built from a secret that was never set or not exposed to the step, so Fastly sees no token.

The token lacks the purge scope or was rotated

A token without the purge capability, or one that has been rotated, authenticates as invalid for purge operations.

How to fix it

Send a valid Fastly-Key from a secret

1. Create an API token with purge scope for the service.
2. Store it as a secret and pass it in the Fastly-Key header.
3. Purge by surrogate key or single URL as needed.

curl -sS -X POST \
  "https://api.fastly.com/service/${FASTLY_SERVICE_ID}/purge/${SURROGATE_KEY}" \
  -H "Fastly-Key: ${FASTLY_API_TOKEN}" \
  -H "Accept: application/json"

Verify the token before purging

Call the current-token endpoint so an expired or unscoped token fails with a clear message.

curl -sS "https://api.fastly.com/tokens/self" \
  -H "Fastly-Key: ${FASTLY_API_TOKEN}"

How to prevent it

• Keep the Fastly-Key in CI secrets and rotate in one place.
• Grant the token purge scope for the target service only.
• Verify the token before the purge step.

Frequently asked questions

Related guides

References

• GitHub Actions documentation