> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opentype.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# missing_credentials

> HTTP 401 on every protected route: no Authorization header, a scheme other than Bearer, or an empty token. How to send an API key correctly.

`missing_credentials` means the request reached a protected route without a usable `Authorization: Bearer` header. Read this page if your first call fails with a 401, or if a proxy or HTTP client drops headers.

| HTTP  | `code`                | Retryable                    |
| ----- | --------------------- | ---------------------------- |
| `401` | `missing_credentials` | No. Send a credential first. |

## What happened

Routes: every protected route under `/v1/`, including runs, keys, usage, quota and billing.

The credential is the first thing OpenType checks, so this error comes before any body or scope check. One of these is true:

| Cause                        | Example                                                                                   |
| ---------------------------- | ----------------------------------------------------------------------------------------- |
| No `Authorization` header    | the header was never set, or a proxy removed it                                           |
| A scheme other than `Bearer` | `Authorization: Basic ...`, `Authorization: Token ...`, or the bare secret with no scheme |
| An empty token               | `Authorization: Bearer ` with nothing after it, often an unset environment variable       |

The scheme name is not case-sensitive: `bearer` works too. There is no other authentication header and no cookie authentication. The response does not carry a `WWW-Authenticate` header.

## How to fix

1. Send `Authorization: Bearer <credential>` on every call. For your code, the credential is an API key: `otsk_` followed by 64 lowercase hex characters.
2. Check that `OPENTYPE_API_KEY` is set in the process that makes the call. An unset variable produces an empty token.
3. If you call through a proxy, gateway or serverless platform, check that it forwards the `Authorization` header.
4. Keep the key on your server. Do not send it from a browser or a mobile app.

If you have no key yet, create one on the [API keys page](/console/api-keys).

## Example

```json theme={"system"}
{"error":{"code":"missing_credentials","message":"a bearer credential is required","request_id":"req_7d3f0c1a9b2e4f6a8c0d1e2f3a4b5c6d"}}
```

A request with the header set, failing early when the key is missing:

<CodeGroup>
  ```bash curl theme={"system"}
  : "${OPENTYPE_API_KEY:?set OPENTYPE_API_KEY first}"

  curl https://api.opentype.dev/v1/runs \
    -H "Authorization: Bearer $OPENTYPE_API_KEY"
  ```

  ```typescript TypeScript theme={"system"}
  const apiKey = process.env.OPENTYPE_API_KEY;
  if (!apiKey) throw new Error("OPENTYPE_API_KEY is not set");

  const res = await fetch("https://api.opentype.dev/v1/runs", {
    headers: { Authorization: `Bearer ${apiKey}` },
  });

  const body = await res.json();
  if (!res.ok) throw new Error(`${body.error.code}: ${body.error.message}`);
  console.log(body.runs.length);
  ```

  ```python Python theme={"system"}
  import os
  import requests

  api_key = os.environ.get("OPENTYPE_API_KEY")
  if not api_key:
      raise RuntimeError("OPENTYPE_API_KEY is not set")

  resp = requests.get(
      "https://api.opentype.dev/v1/runs",
      headers={"Authorization": f"Bearer {api_key}"},
      timeout=30,
  )

  body = resp.json()
  if not resp.ok:
      raise RuntimeError(f"{body['error']['code']}: {body['error']['message']}")
  print(len(body["runs"]))
  ```
</CodeGroup>

## Related

* [Authentication](/security/authentication) - how OpenType reads the bearer credential.
* [invalid\_credential](/problems/invalid_credential) - a credential was sent but rejected.
* [API keys in the console](/console/api-keys) - create a key and copy its secret.
* [Problem codes](/problems) - every code, its status, and whether a retry can help.