PROBABLE SOLUTION TO THE 401 ISSUE WITH WEATHERKIT:
For everyone seeing this issue, what is likely the case is that you're generating the bearer token with a now timestamp and fixed (probably short) expiry. If you're rounding a millisecond timestamp to seconds to create that token you will likely see a certain percentage of requests with a JWT that is a few milliseconds too young to be valid yet (depending on exact time-shift with Apple's servers). Generate the token with a few seconds negative offset versus "now" and you'll be fine.
This worked like a charm for us.