The MCP server returns 401 with this message when the Bearer token doesn't match any active row in api_keys.
Check the obvious first: did you paste the whole key (ct_live_ prefix + 32 chars)? Any trailing spaces or newlines will break the SHA-256 hash check.
Open /keys — if the key you're using isn't listed there, it's been revoked. Create a fresh one.
If you're using OAuth (not a static API key), the error message will be slightly different ("Invalid or expired access token"). In that case, have your client re-authorize against /oauth/authorize.