## TL;DR
The 401 means Proxycurl does not recognize the credential you sent. Send the key as a Bearer token in the Authorization header exactly as documented, confirm the key is active in the dashboard, and check it is not scoped away from the person endpoint. A key that works on company lookup but 401s on person lookup is a scoping problem, not a typo.

```text
proxycurl 401 invalid api key on person profile endpoint
```

## Use this when
- The person profile endpoint returns 401.
- The same key works on other endpoints or used to work.
- You just created or rotated the key.

## Not for this skill when
- The error is 404. The key is fine; the profile is missing.
- The error is 402. That is credits, not auth.

## Steps
1. Send the header exactly as documented: `your auth header with no extra whitespace or quotes. Verify: a curl with the literal header reproduces or clears the 401.
2. Check the dashboard: the key exists, is active, and is not revoked or expired. Verify: status reads active.
3. Confirm the key has person-endpoint scope. Some keys are issued per product. Verify: the dashboard shows person API enabled for the key.
4. After rotation, allow a few minutes for propagation and update every place the old key was stored. Verify: no stale copies in env files or CI secrets.
5. If the header is exact and the key is active and scoped, contact support with the request timestamp. Verify: you have a support thread, not a guessing loop.

## Variant phrasings
### proxycurl 401 unauthorized
The short search, same header-first fix.
### proxycurl api key not working
Symptom phrasing, points at step 2.
### proxycurl person endpoint auth failed
Endpoint phrasing, lands on the scoping check.

Compatibility: Proxycurl API, Bearer auth. Header formatting is the number one cause.

## Why it happens
API gateways reject the key before any business logic runs, so a 401 never tells you whether the profile exists. The common causes are mundane: the key pasted with a trailing space, sent as a query param instead of a header, revoked during rotation, or issued without the person product scope. The fix is always in the credential plumbing, never in the lookup.

## Edge cases / pitfalls
- Never log the full key when debugging 401s. Log the last four characters.
- Keys in client-side code get harvested and revoked. Server-side only.
- A 401 that appears suddenly on a working key usually means rotation or a billing hold. Check both.
- Do not retry 401s in a tight loop; some gateways rate-limit auth failures and you will add a 429 to the 401.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_6zm8Z8Hjj2xJLcree2xxPQ