New Relic CLI "API key invalid" in CI

By Kaveh Alemi·Latchkey

New Relic rejected the request because the API key is invalid: it is empty, the wrong key type (a license key where a User key is required), or scoped to a different region (US vs EU). The endpoint is reachable; the key is not accepted.

What this error means

newrelic-cli or a NerdGraph call fails with "Invalid API key", "Authentication required", or a NerdGraph response complaining the key is not valid.

Error: failed to execute request: 401 Unauthorized
  {"error":"Invalid API key"}

Common causes

The wrong key type for the API

NerdGraph and the CLI need a User API key; passing a license key or ingest key is rejected as invalid.

A region mismatch (US vs EU)

A key from an EU account used against the US endpoint (or vice versa) is not recognized, so the request fails.

How to fix it

Use a User key and the right region

1. Create a User API key in New Relic (not a license/ingest key).
2. Set the region to match your account.
3. Store the key as a secret and re-run.

env:
  NEW_RELIC_API_KEY: ${{ secrets.NEW_RELIC_API_KEY }}
  NEW_RELIC_REGION: US

Verify the key with a simple query

Confirm the key authenticates before the real step by running a minimal NerdGraph query.

newrelic nerdgraph query '{ actor { user { email } } }'

How to prevent it

• Use a User API key for the CLI and NerdGraph.
• Set the region to match the account (US or EU).
• Keep the key in a CI secret and validate it early.

Frequently asked questions

Related guides

References

• GitHub Actions documentation