API keys and account limits - Millwork

Credentials are separate

Credential	Used for	If lost or exposed
Browser session	Human dashboard access	Sign out and sign in again. Contact support if the account may be compromised.
Organization API key	Application API requests	Create a replacement, update the application, then revoke the old key.
Provider credential	Calling the connected provider	Rotate it at the provider and through Millwork secure setup.

Authentication and permission

What you see	What to do
`401 unauthenticated`	Check the `Authorization: Bearer` header. If the key may be wrong, replace it. Do not keep retrying the rejected key.
`403 permission_denied`	Use the correct organization role. Billing and member actions may require a human dashboard session.
A role changed but the dashboard still shows old access	Sign out and sign in again.

Credit and account limits are different

What you see	Meaning	What to do
`402 insufficient_credit`	The prepaid balance cannot fund another live run.	Add credit and confirm the new balance before retrying.
`429 quota_exceeded`	A monthly or concurrent account limit was reached.	Check `/v1/account`. Wait for the stated delay, a running job to finish, or the reported reset time.
`429 rate_limited`	Requests are arriving too quickly.	Wait for `Retry-After` or `retry_after_s`.
`409 credit_wallet_frozen`	Billing needs review.	Stop retrying and contact support.
`503 billing_unavailable`	Millwork cannot process billing requests now.	Retry later. Contact support if it continues.
A dashboard payment action did not change the balance	The account is not ready for funded work.	Refresh `/v1/account`. If it does not change, contact support. Do not submit funded work yet.

Payment and billing changes are human dashboard actions. An organization API key cannot manage payment. When you use your provider account, that provider bills your organization directly. Millwork credit and usage limits can still stop a run.

Replace an organization key

Create and test the replacement before revoking the old key.

Contact support

Send safe account or billing context without payment details, credentials, or customer data.

⌘I