fetchContent works locally but returns auth errors in prod, API key looks fine
Deployed our Next.js storefront with both env vars set:
NEXT_PUBLIC_CROCT_APP_ID=...CROCT_API_KEY=...Locally everything works. In production every server-side fetchContent call fails with:
Error: Invalid credentialsI created the API key myself in the dashboard yesterday, copied it straight into the environment settings, triple checked for whitespace. The public app ID is definitely correct because client-side tracking shows up in the dashboard. What else could make the key invalid on the server only
1 answer
The key itself is probably fine; the problem is its permissions. Server-side functions in @croct/plug-next use the API key to issue user tokens, so the key referenced by CROCT_API_KEY must have the "Issue user tokens" permission. A key created without it looks perfectly valid but fails authentication for exactly the calls you are describing, while client-side tracking (which only needs the public app ID) keeps working.
To fix it:
- Create a new API key with the "Issue user tokens" permission enabled, either in the dashboard or from the terminal with npx croct create api-key.
- Replace CROCT_API_KEY in your production environment with the new key.
- Redeploy so the server picks up the new value.
Note that NEXT_PUBLIC_CROCT_APP_ID alone is never enough for server functions; the API key is what authenticates them. The likely reason it works locally is that your local environment still holds an older key that has the permission.