Mailgun “401 Forbidden”: wrong key, wrong region or wrong user

What Mailgun answered

On 16.10.2026 we posted a message to /v3/<domain>/messages with a made-up key on both of Mailgun's API hosts. Each answered HTTP 401, content-type: text/plain, and a body of one word: Forbidden. A request with no key at all got the same answer.

Three ways it showed up in code:

• fetch plus response.json() in Node: SyntaxError: Unexpected token 'F', "Forbidden" is not valid JSON. The real problem, the key, is hidden behind a parse error. See why JSON parse errors look like this.
• mailgun.js 14.1.0: an error with message: "Unauthorized", status: 401 and details: "Forbidden". With the key variable unset it threw Parameter "key" is required before sending anything.
• SMTP through smtp.mailgun.org with a made-up password: Invalid login: 535 Authentication failed.

What to check

A made-up key cannot tell these apart, because Mailgun gives the same one-word answer for all of them. These are the causes Mailgun's docs describe, in the order worth checking:

1. Region. A domain created in the EU region lives on api.eu.mailgun.net. Calling api.mailgun.net for it fails. In mailgun.js, pass url: "https://api.eu.mailgun.net".
2. User name. Basic auth uses the user api and the key as the password.
3. Key type. Mailgun's docs say a domain sending key only allows POST to /messages and /messages.mime, for the domain it was created for. Other endpoints, or another domain, need the account's API key.
4. A replaced key. After you create a new key and delete the old one, every place that still has the old one gets 401.

Do not call Mailgun from the page

Unlike SendGrid, Mailgun's API answered the browser preflight with Access-Control-Allow-Origin: * and allowed the Authorization header. So a call from front-end code works, and that is the danger: the key is then in your page for anyone to copy, and it can send mail as your domain. Keep the call on a server or in a function.

Do you need a Mailgun key for a contact form?

If the API key is in your project only so a contact form can email you, a form that posts to Formgong at https://formgong.com/submit needs no key from a mail provider, and Formgong sends the notification. See the HTML guide.