The 401 Unauthorized response seems to happen when either
1) a valid key has exceeded 1500 API calls/day, or >30 calls per minute or
2) it's not a valid key
Unfortunately, there's no way to tell the difference based solely on the 401 response.
There are several people who are still experiencing the (1) above, even after installing the V1.10 WXDailyHistory.php script -- In discussions with Victoria, she can use the management interface to get the counts (mere mortals can't), but apparently, they don't have the ability to get API calls using a key by IP addresses doing the calls, so there's not a mechanism to tell if someone has poached your key and thereby running up your counts.
The V1.10 of the script carefully limits API calls to once per 2.5 minutes for daily stats, and once per 30 minutes for week/month/year calls, so I don't know where else the calls can be coming from. Send a note to victoria.gardner@ibm.com with your API key, WUID and ask for diagnosis.