401 Unauthorized
Check that the request uses the correct environment, includes the API credential exactly once and that the key has not been revoked or rotated.
Check header
Authorization: Bearer YOUR_MAY_API_KEY403 Forbidden
The credential may be valid but not allowed to perform that operation. Check the key/account permissions and the business context associated with the request.
Browser CORS error
Do not move a private API key into browser JavaScript to “solve” CORS. Use the public widget for website conversations or call MAY from your own backend.
Widget does not load
Generated script URL returns successfullyCurrent host/domain is allowedNo Content Security Policy blockSnippet included onceCorrect public widget configuration selected
Webhook not arriving
Endpoint is publicly reachable over HTTPSEndpoint responds successfully without a long delayExpected event is enabledSignature verification matches the deployed MAY documentationDuplicate delivery is handled safely