# LaunchDarkly 401 "invalid SDK key" in CI

> Fix LaunchDarkly "HTTP error 401 (invalid SDK key)" in CI - the SDK reached LaunchDarkly but the server-side SDK key it sent was missing, wrong, or from the wrong environment.

Source: https://latchkey.dev/learn/ci-integrations/launchdarkly-401-invalid-sdk-key-in-ci  
Updated: 2026-06-30

The LaunchDarkly SDK authenticated against the streaming or polling endpoint and was rejected with HTTP 401. The service is reachable; the SDK key you passed is invalid, empty, or belongs to a different environment. The SDK stops fetching flags and serves fallback defaults.

## Diagnose it: did the report reach the service?

Coverage and quality integrations fail in two distinct places: the report was never produced, or it was produced and the upload was rejected. Establish which before touching tokens.

```Terminal
# 1. does the report exist and is it non-empty?
ls -la coverage/ && head -5 coverage/lcov.info

# 2. does it reference paths the service can map to the repo?
grep "^SF:" coverage/lcov.info | head -5

# 3. did the upload actually succeed, or just not fail the step?
# most uploaders exit 0 on a rejected upload unless told otherwise
```

> Absolute paths in an lcov report break file mapping on the service side, so coverage appears as zero even though the upload succeeded. Generate reports with paths relative to the repository root.

## FAQ

### What causes LaunchDarkly 401 "invalid SDK key" in CI?

There are 2 common causes: the server-side sdk key is missing or empty in ci and a mobile or client-side id was used instead of the server sdk key. The secret was never exposed to the job, so the SDK client is constructed with an empty string and LaunchDarkly rejects it with 401.

### How do I fix LaunchDarkly 401 "invalid SDK key" in CI?

There are 2 fixes depending on which cause you have: inject the correct server-side sdk key from a secret and verify the key matches the target environment. Work through them in order, since the first is the most common.

### What does LaunchDarkly 401 "invalid SDK key" in CI actually mean?

LaunchDarkly logs "Error on stream connection: HTTP error 401 (invalid SDK key), giving up permanently" or "Received HTTP error 401 ...

### How do I stop LaunchDarkly 401 "invalid SDK key" in CI happening again?

Keep the LaunchDarkly SDK key in CI secrets, never committed. The prevention section lists 3 changes that keep it from recurring.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt