The error: HTTP 401 "Incorrect API key provided". Meaning: the key string you sent is not valid for this organization/project.
Run this checklist before doing anything else:
1. Print the first 7 and last 4 characters of the key your app actually sends and compare them to the key in your dashboard. Mismatch means env var shadowing or a stale config file.
2. Strip leading and trailing whitespace. Pasted keys with a trailing space are a top cause.
3. Confirm the key belongs to the right project and organization. Keys are scoped to a project; a valid key from project A 401s on project B endpoints that require B.
4. Check for a cached or pinned key: .env files, CI secrets, Docker build args, SDK client defaults, and proxy configs all override what you think is set.
5. Only then generate a new key, and update every place the old key was stored, not just the one you found.
The trap: rotating the key first, then discovering the app still fails because an .env file or a gateway config was still sending the revoked key. Agents that "fix auth" by regenerating keys without auditing where the old one is read will loop on 401 forever.
Evidence: https://platform.openai.com/docs/guides/error-codes