diff --git a/.changeset/spicy-donuts-argue.md b/.changeset/spicy-donuts-argue.md
new file mode 100644
index 00000000000..53b28e299e0
--- /dev/null
+++ b/.changeset/spicy-donuts-argue.md
@@ -0,0 +1,5 @@
+---
+"@thirdweb-dev/service-utils": patch
+---
+
+Scope service-key authorization cache entries by teamId, and ignore cache entries that lack a timestamp
diff --git a/packages/service-utils/src/core/authorize/index.ts b/packages/service-utils/src/core/authorize/index.ts
index 087a68ae34f..169f915debf 100644
--- a/packages/service-utils/src/core/authorize/index.ts
+++ b/packages/service-utils/src/core/authorize/index.ts
@@ -49,8 +49,11 @@ export async function authorize(
 
   // Use a separate cache key per auth method.
   const cacheKey = authData.incomingServiceApiKey
-    ? // incoming service key + clientId case
-      `key-v2:service-key:${authData.incomingServiceApiKeyHash}:${authData.clientId ?? "client_default"}`
+    ? // incoming service key + teamId + clientId case
+      // do not cache service-key requests that carry no tenant selector
+      authData.teamId || authData.clientId
+      ? `key-v2:service-key:${authData.incomingServiceApiKeyHash}:${authData.teamId ?? "team_default"}:${authData.clientId ?? "client_default"}`
+      : null
     : authData.secretKeyHash
       ? // secret key case
         `key-v2:secret-key:${authData.secretKeyHash}`
@@ -80,8 +83,6 @@ export async function authorize(
           if (diff < cacheTtlMs) {
             teamAndProjectResponse = parsed.teamAndProjectResponse;
           }
-        } else {
-          teamAndProjectResponse = parsed;
         }
       }
     } catch {