Troubleshooting

API key is set in .env but still getting 401

Your components.json references the key via ${SHADCNBLOCKS_API_KEY}, which the CLI expands from your environment. Sometimes the variable is present in your .env file but isn’t actually being loaded (wrong file name, wrong location, the tool not loading .env in that context, a stale shell session, etc.). The reasons vary, so the fastest way to isolate it is to test with the key hardcoded:

1. Temporarily replace the env reference in components.json with the raw key:

{  "registries": {    "@shadcnblocks": {      "url": "https://www.shadcnblocks.com/r/{name}",      "headers": {        "Authorization": "Bearer sk_live_your_actual_key_here"      }    }  }}

2. Run your install command again.

If the install now succeeds, the key itself is valid and the problem is that your .env isn’t being read — check the file name/location, confirm the variable name matches SHADCNBLOCKS_API_KEY exactly, and restart your terminal/dev process so it picks up the value. If it still fails, the key may be invalid, expired, or revoked — generate a new one from your dashboard.

⚠️ Security warning: The hardcoded key is only for local testing. Revert to ${SHADCNBLOCKS_API_KEY} before committing — never commit an API key to your repository, as it’s a security risk.

CLI run from wrong directory

The shadcn CLI reads components.json (and .env) from the directory where you run the command. If you run npx shadcn add from the wrong folder, it may use a different config — or fail to find the components.json at all. When this happens the error may still present as an auth error even if your API key is correct.

Common cases:

• Wrong subdirectory — e.g. running from src/components/landing instead of the project root where components.json lives
• Monorepos — running from the repo root while package.json and components.json are in an app package (e.g. apps/web)

Run the command from the same directory as your package.json and components.json:

# from the app that owns components.jsoncd apps/web   # or your project rootnpx shadcn add @shadcnblocks/hero-1

Non www url redirection stripping auth headers

If you use the non-www URL (https://shadcnblocks.com/r/{name}), the request is redirected to www. On that redirect most HTTP clients drop the Authorization header for security reasons, so your API key never reaches the server and you get a 401.

This was broken in shadcn CLI 4.11.1+ when native fetch replaced node-fetch, which strips the header on apex → www redirects. That issue has been fixed in the latest CLI versions, so with an up-to-date shadcn it should not matter whether you use the www or non-www URL. Other clients and runtimes — bunx, Deno, CI scripts, and AI site builders — may still strip the header on redirect.

To be safe, prefer the www host in your components.json anyway — it avoids the redirect entirely:

{  "registries": {    "@shadcnblocks": {      "url": "https://www.shadcnblocks.com/r/{name}",      "headers": {        "Authorization": "Bearer ${SHADCNBLOCKS_API_KEY}"      }    }  }}