The order.

No valid API key (code = unauthorized): missing, malformed, unknown, revoked or expired, or a wrong secret. The message is worded for an API key — this surface has no session to sign in to.

The key is valid but the request is not allowed: api_access_inactive (the workspace may not use the API right now; reason says why and paidThroughUtc until when it was paid, when known), ip_not_allowed (the key is not accepted from the request's source address), or forbidden (the key lacks the required scope).

No such resource in this workspace, or no such route (code = not_found).

A request budget is spent (code = rate_limited): the workspace's 120 requests per minute, the catalog images' 300 per minute, or the per-address limits applied before the key is checked. Retry-After is 60 for a per-minute budget and 1 for the per-address concurrency cap; a per-minute refusal also carries RateLimit-Limit, RateLimit-Remaining (0) and RateLimit-Reset.