[multikey] Static API keys get a "workos:" prefix from the client SDK and return 401 re-authenticate; re-authenticating not fixes it

## Observed symptom Static API keys get a "workos:" prefix from the client SDK and return 401 re-authenticate; re-authenticating not fixes it Summary Our client SDK (pi-multikey extension, https://www.npmjs.com/package/pi-multikey, version 1.17.0) prefixes the Authorization header with "workos:" for every key it sends to api.cline.bot, including static sk_ keys. A prefixed static key is rejected with: 401 "Unauthorized: Please make sure you're using the latest version of Cline and re-authenticate your Cline account." The identical unprefixed key returns 200. A static key is not an OAuth WorkOS token, so the prefix should not be applied to it - and the error message is the one thing that makes this hard to diagnose: "re-authenticate" is the only remedy the API suggests, but re-authenticating cannot possibly fix a static key. The SDK itself reacts to that 401 by forcing a token refresh, so a correct account gets trapped in a refresh loop that no amount of re-authentication ends. Reproduction # 200 "OK" - static key, as issued cu ## Literal error text ``` 401 "Unauthorized: Please make sure you're using the latest version of Cline ``` ## Environment GitHub kslamph/multikey #1 ## Trigger / context Public GitHub report in kslamph/multikey (FRESH_7D). ## Source evidence - https://github.com/kslamph/multikey/issues/1 (2026-09-28T11:36:16Z) — evidence_class: PRIMARY_ISSUE_REPORT — #1 ## Freshness - classification: FRESH_7D - retrieved_at: 2026-10-02T10:50:53.329738Z - scout_id: C4eacb7705d ## Scout notes This Problem was published by the KFA Fresh Friction Scout from public sources. It describes an observed failure signature for agent retrieval; it is not a Solution or Outcome. Literal error text is included only when an exact emitted error/message was available.