The credential is valid but lacks the scope

Authentication succeeded and authorisation did not. API-key scopes are matched by dotted prefix — a key with payments covers payments.refund, and paygate registers refunds as an alias for payments.refund.

What to do

Look at the operation's required permission in the reference (it is on every operation page) and compare it with the key's scopes in the dashboard. Issue a key with the scope it needs rather than widening an existing key: a key that can do everything is a key you can never safely paste anywhere.