Fix “Your API key is invalid” in Akismet Anti-spam

If you are wondering what is broken: Akismet is rejecting the key WordPress is sending. Either the key is wrong, the subscription or plan behind it has an issue, or WordPress is pulling the key from the wrong place.

Why this error shows up

Akismet protects your comments by calling its API with your API key and your site details. If Akismet cannot match that key to a valid, active subscription for this site, it replies “invalid” and the plugin shows:

Your API key is invalid.

Most of the time, one of these is true:

• The key was pasted incorrectly or has extra spaces or characters.
• The key’s plan is missing or suspended in your Akismet account (no plan selected, billing issue, or canceled subscription).
• You are using a Personal key on a commercial site and the key was flagged until you upgrade to a commercial plan.
• Your key was moved to a different site or account, and this domain is no longer allowed.
• On multisite or Jetpack setups, the key is defined in more than one place and Akismet is not reading the one you think.

We will fix the simple copy or plan problems first, then handle network and constant based setups, then cover what to send to Akismet support if it still shows as invalid.

Step 1: Confirm you have the right key and account

1.1 Get your current key from Akismet

1. Go to akismet.com/account and sign in with the email you used for Akismet.
2. On the Subscriptions page, find the plan that lists your site.
3. Copy the API key shown there.

If you cannot find the key, use Akismet’s “Resend API key” option from their support docs or account screen and check your email.

1.2 Check the plan and site type

On that same account screen:

• Make sure the subscription status is active, not canceled or expired.
• If you are on a Personal plan but your site is commercial (business, e commerce, agency, school etc), plan to switch to a commercial plan. Personal keys are for non commercial sites only. Using them on commercial sites can cause suspension.
• Confirm the domain you are protecting appears in the list of sites for that key, and that it is spelled correctly.

If the plan is paused or you have no plan at all, fix that first. Once the subscription is active again, the same key will start working once the plugin re verifies it.

Step 2: Re enter the key cleanly in WordPress

2.1 Standard Akismet plugin

1. In WordPress, go to Settings → Akismet Anti spam (or Akismet Anti spam from the sidebar).
2. If you are already connected, click any Disconnect, Change key, or similar link to clear the old key.
3. Paste the key from your Akismet account into the API key field.
   • Paste it into a plain text editor first if you are worried about hidden characters.
   • Make sure there are no spaces before or after the key.
4. Click Connect with API key or Save changes.

If the key and plan are valid, the page should update to show that Akismet is now protecting your site and how many spam comments have been blocked.

2.2 Jetpack managed Akismet

If you manage Akismet through Jetpack:

1. Go to Jetpack → Akismet Anti spam in your dashboard.
2. If you see a notice like “Your API key is no longer valid. Please enter a new key or contact support@akismet.com.”, click the link to enter a new key.
3. Paste the correct key from your Akismet account and save.

If Jetpack still shows your key as invalid even after you confirm it and your plan is active, move on to the next steps.

Step 3: Clean up conflicting keys (wp-config and multisite)

On older or more customized installs, the key may be hard coded in wp-config.php or provided by a network wide mu plugin.

3.1 Check for hard coded constants

1. Connect via FTP or your file manager.
2. Open wp-config.php in your WordPress root.
3. Search for lines that mention WPCOM_API_KEY or AKISMET_API_KEY, for example:

   define('WPCOM_API_KEY', 'your-key-here');

4. If you find an old key there:
   • Update it to the current key from your Akismet account, or
   • Comment it out if you want to manage the key only from the Akismet settings screen.
5. Save the file and reload your Akismet settings page in WordPress.

Plugin updates can also change how the key is read. If you previously edited akismet.php directly to hard code a key, that change may have been overwritten. Move any custom key definition into wp-config.php or a small mu plugin instead, so it survives updates.

3.2 Multisite and network wide keys

On WordPress multisite, you might be using a single key for all sites:

• Check if your network setup uses an mu plugin or wp-config.php to auto configure Akismet for each site.
• Make sure the same key you verified in your Akismet account is the one that code is using.
• Do not hard code different keys in different places. Pick one place to define the key for the whole network.

If some subsites show “Your API key is invalid” but others work, make sure they all point to the same, active key and that none of them are still using an outdated key saved in their own site options.

Step 4: Rule out connectivity and server quirks

Normally, “Your API key is invalid” means Akismet responded clearly that the key is not acceptable. But if the server cannot reach Akismet correctly, key checks can also fail.

4.1 Test basic connectivity to Akismet

If you have SSH access, ask your host or run:

curl -I https://rest.akismet.com/1.1/verify-key

• If you get an HTTP response back, the server can reach Akismet.
• If it hangs, times out, or fails DNS resolution, you may have a firewall or DNS problem to fix with your host.

From Akismet’s side, most API calls go to hostnames like api_key.rest.akismet.com and a small set of IPs. If your host uses IP based firewall rules, they may need to allow those IPs so your site can talk to Akismet.

4.2 Let Akismet re verify from a clean state

1. Temporarily switch to a default theme such as Twenty Twenty Four.
2. Deactivate all plugins except Akismet (and Jetpack if you rely on it to manage Akismet).
3. Re enter the correct key once more on the Akismet settings page.
4. Submit a test comment on a post to force a spam check.

If the key validates in this minimal state but shows as invalid again when you re enable other plugins, there may be a plugin that filters or overrides HTTP requests or Akismet’s settings. In that case, re enable plugins one by one until you find the conflict.

If you still see “Your API key is invalid”

At this point, you have:

• Confirmed the key from your Akismet account.
• Checked that the plan is active and matches your site type.
• Cleaned up hard coded keys and conflicting settings.
• Verified basic connectivity to Akismet.

If the plugin still insists that your key is invalid, it is time to loop in Akismet’s support so they can look at the key and your site from their side.

4.3 Contact Akismet support with the right details

From the email address on your Akismet account, send a message to their support including:

• Your API key (you can partially mask it if you prefer, but include enough to identify it).
• The domain of the site that shows “Your API key is invalid”.
• Whether the site is personal or commercial, and which plan you believe you are on.
• A screenshot of your Akismet account page showing the subscription and this site.

Ask them to confirm that the key is valid, on the right plan for this site, and not suspended. They can also tell you if they see any usage problem from that site that would cause the key to be flagged.

Verification: how to know it is fixed

You are in good shape when:

• The Akismet settings page shows the key as connected and no longer displays “Your API key is invalid”.
• New comments are being checked and spam is being sent to the spam folder again.
• Your Akismet account page shows an active plan with this domain listed.
• No new entries in your error logs mention invalid key responses from Akismet.

Still stuck?

For AI help

Hit Continue Chat below and send me:

• A screenshot of your Akismet settings page in WordPress.
• A screenshot of your Akismet account showing the key and plan.
• Whether your site is personal or commercial, and whether you use Jetpack or multisite.

I will help you line up your key, plan, and site configuration so Akismet accepts it again.

For expert human help

Scroll down to the contact form below. Enter your name, email, and WordPress needs. Atiba will get back to you as soon as possible.