New Live REST API keys return 400 Invalid Authorization header

API Issues
1

Two distinct Live REST API keys generated today for the same application are both rejected by the Companies House Public Data API.

Application: MILADVector
Application environment: Live
Key type: REST API key
Restrictions: no restricted IPs and no JavaScript domains

Endpoint tested:

GET https://api.company-information.service.gov.uk/company/05386273

Minimal reproduction:

curl -i -u '<API_KEY>:' \
  -H 'User-Agent: MILADVector/1.0' \
  https://api.company-information.service.gov.uk/company/05386273

Expected: HTTP 200 with the company profile.

Actual response from both keys:

HTTP 400
{"error":"Invalid Authorization header","type":"ch:service"}

Checks already completed:

  • Copied each key using the Developer Hub Copy key control.
  • Used HTTP Basic authentication exactly as documented, with the API key as username and a blank password.
  • Tested independently using macOS curl and Node fetch from a production server in London.
  • Generated a second distinct Live REST key after the first failed; it produced the identical response.
  • Retried the original key after more than ten minutes to rule out a short propagation delay.
  • As a control, a deliberately invalid short credential returns HTTP 401 Invalid Authorization rather than this HTTP 400 Invalid Authorization header response.
  • Confirmed the application is Live and both credentials are REST API keys.

No key values are included in this public post. Please check whether newly issued Live REST keys for this account/application are being activated correctly, or advise what additional non-secret diagnostic information is required.

2

Update after account approval:

  • I received confirmation that the Companies House account/application is now approved.
  • I then generated a fresh Live REST API key after that approval.
  • The new key is distinct from the previously issued credential.
  • I tested the fresh key with the same documented HTTP Basic authentication request from macOS curl, both immediately and again after an activation delay.
  • Every attempt still returns HTTP 400 with {“error”:“Invalid Authorization header”,“type”:“ch:service”}.
  • The fresh key has not been published or disclosed.

This rules out the failure being limited to a key generated before account approval. Could Companies House please confirm whether a further activation step is required, or investigate whether newly issued Live REST keys for this account are being registered correctly?