Heroku "Invalid credentials provided" (HEROKU_API_KEY) in CI

By Daniel Zoghalchali·Latchkey

The Heroku CLI authenticates non-interactively with HEROKU_API_KEY. When the key is unset, expired, or wrong, the platform rejects the request with "Invalid credentials provided".

What this error means

A Heroku CLI command in CI fails with "Invalid credentials provided." or "Your API key is expired or invalid".

 ▸    Invalid credentials provided.

Common causes

Missing or wrong API key

CI cannot run heroku login, so without a valid HEROKU_API_KEY the CLI has no usable credential.

An expired or rotated key

The key was regenerated or the account password changed, invalidating the old key the CI secret still holds.

How to fix it

Set HEROKU_API_KEY from a secret

1. Generate an authorization token with heroku authorizations:create.
2. Store it as a CI secret named HEROKU_API_KEY.
3. Expose it to the deploy step env.

env:
  HEROKU_API_KEY: ${{ secrets.HEROKU_API_KEY }}

Rotate and update an expired key

If the key expired, create a new long-lived authorization token and update the CI secret.

heroku authorizations:create -d "ci-deploy"

How to prevent it

• Use a long-lived authorization token, not an interactive login.
• Keep HEROKU_API_KEY in CI secrets.
• Rotate the token on a schedule and update the secret centrally.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation