missing_credentials

{
  "meta": {
    "requestId": "req_3k2j1h0g9f8e7d6c"
  },
  "error": {
    "code": "err:frontline:client:missing_credentials",
    "message": "Authentication required. Please provide a valid API key."
  }
}

​

If you’re calling an API hosted on Unkey

curl https://api.example.com/v1/items \
  -H "Authorization: Bearer <your_api_key>"

• The Bearer prefix is missing. It isn’t case-sensitive, but without it the header is ignored.
• The header is there but empty. That counts as missing.
• The owner uses a custom header or query parameter. Use exactly the name they gave you.
• You don’t have a key. Only the API owner can issue one.

​

If you own this API

• Callers send the key somewhere the policy doesn’t look.
• A stripPrefix doesn’t match what callers send. For example, stripPrefix: "Key " finds nothing in Authorization: Bearer ....

​

How to fix

1. Compare where your callers send the key with the policy’s key locations.
2. Add a second location if you need to accept both styles, and remove or loosen a stripPrefix that callers don’t send.
3. Create a new deployment. The running deployment keeps the policies it started with.

​

Related errors

• err:frontline:client:invalid_key: a key was found but didn’t verify.
• err:frontline:client:insufficient_permissions: the key verified but lacks the required permissions.