invalid_credential

KEY="$(printf '%s' "$OPENTYPE_API_KEY" | tr -d '[:space:]')"

case "$KEY" in
  otsk_*) ;;
  *) echo "OPENTYPE_API_KEY does not start with otsk_" >&2; exit 1 ;;
esac

curl -s -o /dev/null -w '%{http_code}\n' 'https://api.opentype.dev/v1/runs?limit=1' \
  -H "Authorization: Bearer $KEY"

const key = (process.env.OPENTYPE_API_KEY ?? "").trim();
if (!/^otsk_[0-9a-f]{64}$/.test(key)) {
  throw new Error("OPENTYPE_API_KEY is not a full otsk_ secret");
}

const res = await fetch("https://api.opentype.dev/v1/runs?limit=1", {
  headers: { Authorization: `Bearer ${key}` },
});

if (res.status === 401) {
  const { error } = await res.json();
  // invalid_credential: unknown, revoked or rotated key. Do not retry unchanged.
  throw new Error(`${error.code}: replace the key (request ${error.request_id})`);
}

import os
import re

import requests

key = os.environ.get("OPENTYPE_API_KEY", "").strip()
if not re.fullmatch(r"otsk_[0-9a-f]{64}", key):
    raise RuntimeError("OPENTYPE_API_KEY is not a full otsk_ secret")

resp = requests.get(
    "https://api.opentype.dev/v1/runs",
    headers={"Authorization": f"Bearer {key}"},
    params={"limit": 1},
    timeout=30,
)

if resp.status_code == 401:
    err = resp.json()["error"]
    # invalid_credential: unknown, revoked or rotated key. Do not retry unchanged.
    raise RuntimeError(f"{err['code']}: replace the key (request {err['request_id']})")