A Logic App that gets 401 or 403 from Key Vault was refused by one of three layers: token, permission or firewall. Read the error, then fix the managed identity, RBAC role or access policy, or the network path.
Import an Azure Function into API Management, give clients an APIM subscription key while APIM holds the Function host key, then lock down the Function so callers cannot bypass APIM.