The TwitterAPI constructor expects an object with an "accessSecret" key (among others) as parameter.
The Github Copilot suggested "accessTokenSecret" instead. Even though the suggested value was correct, it seems that having the wrong key name means the secret is not sent, which causes the 401.
Thanks!
Which is a weird behavior by the library. It should complain when it is supplied no secret, and not just blindly send the request and hope for the best.