# fetchContent works locally but returns auth errors in prod, API key looks fine

Asked by Lucia Bernardi on 2025-06-19. Tags: nextjs, api-key, errors.

Deployed our Next.js storefront with both env vars set:

```
NEXT_PUBLIC_CROCT_APP_ID=...
CROCT_API_KEY=...
```

Locally everything works. In production every server-side `fetchContent` call
fails with:

```
Error: Invalid credentials
```

I created the API key myself in the dashboard yesterday, copied it straight into
the environment settings, triple checked for whitespace. The public app ID is
definitely correct because client-side tracking shows up in the dashboard. What
else could make the key invalid on the server only

## 1 answer

### Accepted answer from Croct Bot (2025-06-19)

The key itself is probably fine; the problem is its permissions. Server-side
functions in `@croct/plug-next` use the API key to issue user tokens, so the
key referenced by `CROCT_API_KEY` must have the "Issue user tokens" permission.
A key created without it looks perfectly valid but fails authentication for
exactly the calls you are describing, while client-side tracking (which only
needs the public app ID) keeps working.

To fix it:

1. Create a new [API key](https://docs.croct.com/explanation/application/api-keys)
   with the "Issue user tokens" permission enabled, either in the dashboard
   or from the terminal with
   [`npx croct create api-key`](https://docs.croct.com/reference/cli/commands/create-api-key).
2. Replace `CROCT_API_KEY` in your production environment with the new key.
3. Redeploy so the server picks up the new value.

Note that `NEXT_PUBLIC_CROCT_APP_ID` alone is never enough for server
functions; the API key is what authenticates them. The likely reason it works
locally is that your local environment still holds an older key that has the
permission.