If i understand this right, your client made the API key for you and shared the key/password with you.
Each key can be assigned different access scopes so would guess that reading orders was not enabled. Everything is not enabled by default so your client would need to ensure they've given your the scopes you need. Might be worth checking in with them.
★ I jump on these forums in my free time to help and share some insights. Not looking to be hired, and not looking for work. http://freakdesign.com.au ★