LaunchDarkly 401 "invalid SDK key" in CI

The LaunchDarkly SDK authenticated against the streaming or polling endpoint and was rejected with HTTP 401. The service is reachable; the SDK key you passed is invalid, empty, or belongs to a different environment. The SDK stops fetching flags and serves fallback defaults.

What this error means

LaunchDarkly logs "Error on stream connection: HTTP error 401 (invalid SDK key), giving up permanently" or "Received HTTP error 401 ... invalid SDK key". Every variation call then returns the code default.

[LaunchDarkly] ERROR: Error on stream connection: HTTP error 401 (invalid SDK key)
for URL https://stream.launchdarkly.com/all, giving up permanently

Common causes

The server-side SDK key is missing or empty in CI

The secret was never exposed to the job, so the SDK client is constructed with an empty string and LaunchDarkly rejects it with 401.

A mobile or client-side ID was used instead of the server SDK key

Server SDKs need the "SDK key"; passing the client-side ID or a mobile key returns 401 (invalid SDK key).

How to fix it

Inject the correct server-side SDK key from a secret

1. Copy the environment's server-side SDK key from Account settings, Projects in LaunchDarkly.
2. Store it as a CI secret and expose it to the step as an env var.
3. Confirm you are using the SDK key, not the client-side ID or mobile key.

env:
  LAUNCHDARKLY_SDK_KEY: ${{ secrets.LAUNCHDARKLY_SDK_KEY }}

Verify the key matches the target environment

Each LaunchDarkly environment (test, staging, production) has its own SDK key. A 401 will not clear on retry: confirm the key belongs to the environment your CI run targets.

How to prevent it

• Keep the LaunchDarkly SDK key in CI secrets, never committed.
• Use a dedicated test environment key for CI so production flags stay isolated.
• Fail the job early if the key env var is empty rather than silently serving defaults.

Related guides