Likely a fringe case, but one that took a few days to track down.
If you get the following error response from the GraphQL
UI:
"Error": "Response not Successful: Received Status Code 400"
and you have already been through the process of confirming that your API Key is valid, stored in the target DB, accessible to the current user, etc. then this might help.
We found that this error can mask a response from the CM instance (assuming you're deploying to containers) if you open a terminal to the container from within Docker Desktop and attempt to curl the GQL endpoint...
curl http://localhost/[your GQL endpoint]?sc_apikey=[your API Key Guid]
and you get this response...
"Message": "Provided SSC API Key is not valid"
You may have a browser extension that is interfering with the request.
We didn't spot any difference in the request headers between instances and decompiling the assemblies didn't immediately reveal the source of the error message, but it did reveal that Sitecore is looking for the API Key
in a ViewState
object, which is how we ended up suspecting the browser configuration.
Hopefully, this helps someone else on their headless journey!