Skip to main content
err:user:bad_request:permissions_query_syntax_error
The permissions string you sent to keys.verifyKey isn’t a valid permission query. You get HTTP 400 before the key is checked, and detail gives the position of the problem and what was expected there.
Example response

Likely causes

  • You wrote && or || instead of AND or OR.
  • You put quotes around slugs.
  • A ( has no matching ), or a group is empty: ().
  • A slug has a character outside the allowed set: letters, numbers, dots, underscores, hyphens, slashes, colons, asterisks, and parentheses.
  • A token is where an operator or slug was expected, or the query is blank.
If you pass an array of slugs instead of a string, you get err:unkey:application:invalid_input instead.

How to fix

  1. Fix the query at the position named in detail.
  2. Write it as slugs joined with AND and OR, grouped with parentheses. For example: documents.read AND (billing.read OR billing.write).
  3. If you build the query from user input, validate it first. A syntax error fails the whole request instead of returning valid: false.
Last modified on October 6, 2026