Invalid API key (401): the fix.

The API could not match the request to an active key, so it refused before running the query. The error code says which check failed. A 401 never counts against your monthly requests.

Almost always the value sent is not the value you think. Environment files keep quotes, a trailing newline or a space; a key copied from a terminal can lose characters; a framework can drop custom headers on redirects.

• Quotes or whitespace from .env: CITO_API_KEY="cito_..." read by a loader that keeps the quotes.
• A trailing \n from echo or a secrets manager, which makes the length 70.
• The header name misspelled (x-apikey, api-key) or put in the query string on REST calls.
• A redirect from http:// to https:// that strips custom headers. Call https://api.citoapi.com directly.
• The key rotated in the dashboard while an old deploy still uses the previous one.

Read the key from the environment, strip whitespace and quotes, check the cito_ prefix and the 69-character length before sending, and put it in the x-api-key header. Authorization: Bearer <key> also works.

import os, requests

key = os.environ["CITO_API_KEY"].strip().strip('"').strip("'")
assert key.startswith("cito_") and len(key) == 69, f"bad key: length {len(key)}"

r = requests.get(
    "https://api.citoapi.com/api/v1/cs2/matches/live",
    headers={"x-api-key": key},
    timeout=10,
)
if r.status_code == 401:
    print(r.json()["error"])  # code + message say which check failed
r.raise_for_status()
print(r.json()["data"])

const key = (process.env.CITO_API_KEY ?? "").trim().replace(/^["']|["']$/g, "")
if (!key.startsWith("cito_") || key.length !== 69) throw new Error(`bad key: length ${key.length}`)

const res = await fetch("https://api.citoapi.com/api/v1/cs2/matches/live", {
  headers: { "x-api-key": key },
})
const body = await res.json()
if (res.status === 401) console.error(body.error) // { code, message, status, docs }
console.log(body.data)

curl -s https://api.citoapi.com/api/v1/cs2/matches/live \
  -H "x-api-key: $CITO_API_KEY"

Create a new key in the dashboard and try it with curl from your own machine. If curl works and your app does not, the app is sending something different; log the key's length and first 9 characters, never the whole key.

Every 401 names the exact check that failed (missing, malformed, unknown, revoked or expired), so you fix it once instead of guessing. Keys have one fixed format, cito_ plus 69 characters in total, which you can validate in code before the first request, and a new key works the moment the dashboard shows it.