Three real causes cover every 401 from the API:

1. You're missing the X-API-Key header entirely.
2. Your key doesn't start with sk_live_ or sk_test_ — check you copied the whole key.
3. The key doesn't match any active key on file. This also covers a key that's been rotated past its 15-minute grace period, or one that's been revoked.

If you've checked all three and it's still failing, it's worth confirming you're hitting the right environment (live vs. test key against the matching base URL).