Skip to main content
  1. Confirm that the secret is available only to the server process: KMERHOSTING_API_KEY for API keys.
  2. Call GET https://api.kmerhosting.com/health; this does not require credentials.
  3. Call GET /v1/account with the credential. A 401 indicates an invalid, expired, revoked, or missing credential.
  4. For a 403, inspect the key or OAuth consent scopes and grant only the required scope.
  5. For hosted MCP, reconnect through OAuth rather than copying browser credentials. Request offline_access only if the client needs refresh tokens.
If a secret may be exposed, open Developer → API keys in the Customer Dash, revoke it, and replace it. Never paste a secret into a support request.