# FraudChecker API — Invalid API key fix

The message **Invalid API key** comes from **FraudChecker’s server (HTTP 403)**. Your proxy is working; the token they receive does not match your account.

## Do this (exact order)

1. Open [fraudchecker.link](https://fraudchecker.link) and log in.
2. Go to **Developer API** (same page as “Your API Key”).
3. Click **Copy** next to the key. **Do not type the key from a screenshot** — one wrong character causes 403.
4. On **cPanel** (or your host) → **File Manager** → open `api/creative-fraud-config.local.php`.
   - If the file **does not exist**, copy `creative-fraud-config.example.php` to `creative-fraud-config.local.php` first.
5. Set:

```php
<?php
return [
    'api_key' => 'PASTE_FROM_COPY_BUTTON_HERE',
];
```

6. Save. Confirm there are **no spaces** inside the quotes, no `Bearer` word, and the file is **UTF-8** (no extra characters before `<?php`).
7. **Re-upload** `creative-fraud-config.local.php` if you edit locally — the live site must use the same file as your PC project.

## Checklist

| Item | OK? |
|------|-----|
| Same `api_key` on **live server** as in dashboard | |
| Used **Copy**, not manual typing | |
| `api/fraud-check-proxy.php` uploaded and current | |
| `creative-fraud-config.local.php` is in the **same** `api/` folder as the proxy | |

## Still 403 with a copied key?

- Click **Regenerate** on FraudChecker, **Copy** the new key, update `creative-fraud-config.local.php` again.
- Some hosts strip the `Authorization` header for PHP. Ask support whether `Authorization` reaches `fraud-check-proxy.php`, or search for “cPanel Authorization header PHP” fixes (e.g. `RewriteRule` / `SetEnvIf` for `HTTP:Authorization`).
