## TL;DR

Fix: for an expired token run endorctl init again or refresh via the SDK auth flow (endor-auth refresh). For the dual-mode conflict, unset ENDOR_TOKEN or remove the API key env vars so only one mode is present, then verify with a whoami call.

## Steps

1. 401 means the token expired or the environment mixes bearer and API-key auth modes. Refresh the token or keep only one credential mode, then retry.

## When to use

You are seeing this: 401 means the token expired or the environment mixes bearer and API-key auth modes. Use this skill when you run into "endorctl whoami fails with 401: refresh the token or fix the auth mode".

## When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

## Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

## Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.