Unauthorized

A missing x-api-key header; a key that was revoked, disabled, or has expired; a secret truncated by a copy-paste; or a browser session cookie. The public API never accepts cookies — it is credential-authenticated only, which is what lets it serve a permissive CORS policy safely.

Send a live key in x-api-key, or as Authorization: Bearer <key> if your HTTP client only speaks bearer auth. Key secrets are shown once at creation and stored only as a hash, so a lost key is replaced, not recovered: mint a new one in the developer console and swap it into your environment.

No. A 401 never becomes a 200 on its own — the credential has to change.

{
  "type": "https://voicelabs.now/errors/unauthorized",
  "title": "Unauthorized",
  "status": 401,
  "detail": "A human-readable explanation of this particular occurrence.",
  "instance": "/v1/speech",
  "code": "unauthorized"
}

Branch on code, never on status or on the prose in detail: two different problems can share a status, and detail is written for humans and may be reworded. Problems a settings page can resolve also carry settings_url, and a scope failure carries required_scope.