env0 API 401 Unauthorized in CI

By Kaveh Alemi·Latchkey

env0 API calls authenticate with an API key id and secret (HTTP basic auth). A 401 means the request reached env0 but the credentials were not accepted: blank, wrong, or revoked. The service is up; the key is the problem.

What this error means

A CI step calling the env0 API (to trigger or query a deployment) returns HTTP 401 Unauthorized. Other endpoints behave the same way, so it is authentication, not a bad route.

< HTTP/2 401
{"message":"Unauthorized"}

Common causes

The API key id/secret is missing or wrong

The basic-auth credentials were not injected, or a typo makes them invalid, so env0 returns 401.

The key was revoked

A deleted or disabled API key still reaches the API but is rejected.

How to fix it

Inject the API key id and secret

1. Create an API key in env0 and copy the id and secret.
2. Store them as CI secrets.
3. Send them as basic auth on the API request.

curl -u "${ENV0_API_KEY_ID}:${ENV0_API_SECRET}" \
  https://api.env0.com/deployments/...

Confirm the key has organization access

The key must belong to the organization whose deployments you trigger. Regenerate it in the right org if needed.

How to prevent it

• Store the env0 key id and secret together in CI secrets.
• Rotate keys and update the secret in one place.
• Fail fast if either credential variable is empty.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation