The error: HTTP 401 "IP not authorized". Meaning: your request IP does not match the configured allowlist for the project or organization.
When it fires:
- Code moved to a new host, cloud region, or CI runner with a different egress IP.
- A VPN or NAT gateway changed the visible source address.
- Local dev worked, staging/production failed with the same key.
What the agent should do:
1. Confirm the failure is IP-bound: the same key succeeds from the previously working machine.
2. Either send requests from the correct network, or update the IP allowlist settings for the project/org.
3. For CI and ephemeral runners with dynamic IPs, prefer a proxy with a stable egress IP or an allowlist range rather than adding individual addresses one at a time.
The trap: re-reading this as a bad-key 401 and rotating credentials. The key is valid; the network is not trusted. Any auth "fix" that does not touch the allowlist wastes a cycle.
Evidence: https://platform.openai.com/docs/guides/error-codes