Invalid credentials (HTTP 401) for 'https://repo.magento.com/packages.json', aborting.
Cause
Composer tried credentials for repo.magento.com and the request was refused. This title appears only in interactive runs, from the authentication handler after a repeated HTTP 401 with credentials already present. Noninteractive runs print URL required authentication. The URL varies with the requested metadata or archive.
A search for “could not authenticate” may refer to another Composer version or source host. Use the actual failed host and HTTP status before choosing a fix; do not assume that phrase is the literal Marketplace error in your version.
Check
In an interactive terminal, repeat the failure in the application's directory with the same protected credential environment. Scripts and plugins are disabled, but this command can download packages and change installed files. Keep its output private and record only the host, status and message without credentials. If Composer prompts for credentials, stop: credentials are missing from this check. Composer may offer to save credentials to auth.json in plain text; answer no.
composer install --no-scripts --no-plugins --prefer-dist --no-progress
If the broker's source reports Authorization failed, inspect that source's sync state instead. Vendor HTTP 401 and 403 have the same broker label, so that label alone does not distinguish rejected authentication from a vendor entitlement refusal.
Fix
Check that the credential belongs to the intended purchasing account and can access the required package. For Marketplace HTTP Basic authentication, use the public key as the HTTP Basic username and the private key as the password. Check for wrong, expired or revoked keys before replacing the credential. Supply replacement values through a protected file, secret environment or the broker's source credential form; keep them out of command arguments and shared output. Do not widen another project's access to test a purchased package.
For broker-managed installs, update the credential on the correct project source, reauthenticate if prompted, and enter it again. The UI deliberately discards credential input across reauthentication. Sync the source and retry the application install after the sync succeeds.
Follow Vendor repositories as sources for source ownership and credential entry, and Composer client setup for the separate broker install token. Select its kind and scope using the access model token table.
If the failed host is the broker, use the status checks in Composer authentication failures. Changing Marketplace keys does not repair an expired or revoked broker token.