Scopes
Each key carries scopes; an endpoint needs its scope or answers403 SCOPE_REQUIRED. For this integration ask for:
401 means the key, 403 means the scope. A missing, unknown, revoked or expired key — or a suspended tenant — all answer the same
401 AUTHENTICATION_FAILED, on purpose.