Two different secrets

You are issued two credentials, and they are not interchangeable:

• the API key identifies you and goes in the Authorization: Bearer header;
• the sign key is used only to compute the Signature and is never transmitted.

Signing with the API key by mistake is a common cause of 401.