Insufficient scope
insufficient_scope
The credential is valid and the account is fine. The key simply does not carry the scope this operation requires — required_scope names it, and the response repeats it in a WWW-Authenticate header.
Why it happens
A key minted with read-only scopes calling a generation endpoint. Scopes are chosen at creation and fixed for the life of the key; there is no way to widen one afterwards, and that is the point — a read-only key handed to a third party can never be talked into spending your allowance.
How to fix it
Mint a new key in the developer console with the scope named in required_scope ticked, swap it in, then revoke the old one. If the caller is an OAuth 2.1 application, request that scope during authorization and have the user consent again.
Safe to retry?
No. The same key is refused every time.
What it looks like on the wire
{
"type": "https://voicelabs.now/errors/insufficient_scope",
"title": "Insufficient scope",
"status": 403,
"detail": "A human-readable explanation of this particular occurrence.",
"instance": "/v1/speech",
"code": "insufficient_scope"
}
Branch on code, never on status or on the prose in detail: two different problems can share a status, and detail is written for humans and may be reworded. Problems a settings page can resolve also carry settings_url, and a scope failure carries required_scope.
Every VoiceLabs API error is an RFC 9457 problem document with a stable code.