missing_credentials

missing_credentials means the request reached a protected route without a usable Authorization: Bearer header. Read this page if your first call fails with a 401, or if a proxy or HTTP client drops headers.

HTTP	`code`	Retryable
`401`	`missing_credentials`	No. Send a credential first.

What happened

Routes: every protected route under /v1/, including runs, keys, usage, quota and billing. The credential is the first thing OpenType checks, so this error comes before any body or scope check. One of these is true:

Cause	Example
No `Authorization` header	the header was never set, or a proxy removed it
A scheme other than `Bearer`	`Authorization: Basic ...`, `Authorization: Token ...`, or the bare secret with no scheme
An empty token	`Authorization: Bearer` with nothing after it, often an unset environment variable

The scheme name is not case-sensitive: bearer works too. There is no other authentication header and no cookie authentication. The response does not carry a WWW-Authenticate header.

How to fix

Send Authorization: Bearer <credential> on every call. For your code, the credential is an API key: otsk_ followed by 64 lowercase hex characters.
Check that OPENTYPE_API_KEY is set in the process that makes the call. An unset variable produces an empty token.
If you call through a proxy, gateway or serverless platform, check that it forwards the Authorization header.
Keep the key on your server. Do not send it from a browser or a mobile app.

If you have no key yet, create one on the API keys page.

Example

{"error":{"code":"missing_credentials","message":"a bearer credential is required","request_id":"req_7d3f0c1a9b2e4f6a8c0d1e2f3a4b5c6d"}}

A request with the header set, failing early when the key is missing:

: "${OPENTYPE_API_KEY:?set OPENTYPE_API_KEY first}"

curl https://api.opentype.dev/v1/runs \
  -H "Authorization: Bearer $OPENTYPE_API_KEY"

const apiKey = process.env.OPENTYPE_API_KEY;
if (!apiKey) throw new Error("OPENTYPE_API_KEY is not set");

const res = await fetch("https://api.opentype.dev/v1/runs", {
  headers: { Authorization: `Bearer ${apiKey}` },
});

const body = await res.json();
if (!res.ok) throw new Error(`${body.error.code}: ${body.error.message}`);
console.log(body.runs.length);

import os
import requests

api_key = os.environ.get("OPENTYPE_API_KEY")
if not api_key:
    raise RuntimeError("OPENTYPE_API_KEY is not set")

resp = requests.get(
    "https://api.opentype.dev/v1/runs",
    headers={"Authorization": f"Bearer {api_key}"},
    timeout=30,
)

body = resp.json()
if not resp.ok:
    raise RuntimeError(f"{body['error']['code']}: {body['error']['message']}")
print(len(body["runs"]))

Authentication - how OpenType reads the bearer credential.
invalid_credential - a credential was sent but rejected.
API keys in the console - create a key and copy its secret.
Problem codes - every code, its status, and whether a retry can help.

Overview

Errors

Limits

Release notes

What happened

How to fix

Example

​What happened

​How to fix

​Example

​Related

What happened

How to fix

Example

Related