auth_missing_credentials

Last updated Jun 14, 2026

Cause

Matter returns auth_missing_credentials when an authenticated endpoint receives a request whose Authorization header is absent, empty, or syntactically malformed (for example, missing the Bearer prefix). Every endpoint outside the small set of public health probes requires a bearer token, even those that read only metadata about the calling account.

A common source is a reverse proxy or CDN stripping the header on its way through. Another is a client library that has been initialised without a secret because the environment variable was never set in the deploy. Browser callers that try to use Matter directly will see this on every request: the browser is never an authorised principal, and pk_* publishable keys are still tokens that must be sent.

Fix

1. Confirm the Authorization header is present on the wire. Use curl -v or the request inspector in your HTTP client to see the headers Matter receives.
2. If the header is being stripped, audit your edge tier. CDN configurations sometimes drop Authorization for cache safety — add it to the allowlist.
3. If the caller is a server process, verify the secret is loaded from your secrets manager into the running container. A blank env var produces a blank header.
4. The shape is exactly Authorization: Bearer <token> with one ASCII space. No quoting, no Basic, no other schemes.

Related codes

• auth_token_invalid — the header is present but the token doesn't resolve.
• auth_token_revoked — the header is present and the token is known but killed.
• auth_token_expired — the header is present and the token has timed out.

API reference

• Authentication overview — /api/auth
• Tokens — /api-reference/tokens