Getting "Invalid credentials" calling the API even though my key is set

My server call to the Croct API keeps coming back with:

Invalid credentials

I am certain the key is set. It is in the environment, I logged it (masked) at startup, and the value matches what the dashboard shows. So the key is present and being read, yet the API rejects it.

What actually triggers that error, and how do I confirm whether the key is being sent and accepted correctly rather than just assuming the env var is the whole story?