My LiveKit Cloud project is operational and previous SIP + agent calls worked successfully. However, my current Python LiveKit Agent worker receives 401 Unauthorized when connecting to wss://voice-agent-buntq973.livekit.cloud/agent.
lk room list and lk agent list also return HTTP 401.
Python LiveKitAPIListRooms also returns HTTP 401.
The LiveKit Cloud dashboard works normally and shows previous Agent + SIP sessions.
The helpful clue is that CLI, SDK and worker all fail while the dashboard still works. The dashboard logs in with your browser session, not your API keys, so the problem is the keys or your clock, not the project.
Two things to check:
Stale env vars. LIVEKIT_URL, LIVEKIT_API_KEY and LIVEKIT_API_SECRET in your shell override cli-config.yaml, so lk may be signing with keys from an old project. Unset all three and run lk room list again. Watch for trailing spaces or newlines from copy-paste too.
Clock skew. This breaks every client at once, just like you’re seeing:
ntpdate -q pool.ntp.org
More than a few seconds off and that’s your answer. The guide says the server allows about a minute. Usually happens after a laptop or VM wakes from sleep, and a wrong timezone can put you an hour out.
The error wording tells you which: “token not valid yet” or “token expired” means the clock, “invalid API key” means the keys.
If both look fine, a key that was rotated or deleted in the dashboard would also break all three. Make a fresh key pair and try again. Don’t paste the secret here.