unauthenticated

Not authenticated · HTTP 401

No credential, or one that does not verify: an unknown or revoked API key, a wrong secret, or an access token that is malformed, signed with the wrong secret, or missing a required claim (sub, jti, exp, nbf). A client connecting with a token that lives longer than 600 seconds, or is not valid yet, is refused with this code too, its detail starting token_ttl_too_long or token_not_yet_valid.

What to do: On the control API, check the Authorization header is Bearer <api_key>.<api_secret> with a key that has not been revoked. On a client, check your token endpoint mints with the same application's key and secret the deployment knows. Retrying the same credential will not help.

Where it comes from:

• Control API
• Signaling — a client's connect, a request, or an event

Branch on code; detail is for your logs and never for a user. All error codes.