CLI login fails and the Hub UI login works
The same person can open Hub in the browser and gets 401 from ol login with an API key. Is the password wrong?
They are different credentials. The Hub UI signs in with the tenant identity. The CLI uses an API key from that Hub, or ol login against that hub URL. A 401 on the key means the key is wrong, expired, or issued on a different Hub. Resetting the UI password will not fix a key from another tenant.