EC
UNAUTHENTICATED
gRPCERRORCommonAuthenticationHIGH confidence

The request does not have valid authentication credentials for the operation

What this means

Indicates the request lacks valid authentication credentials. This means the client should provide credentials or refresh expired ones.

Why it happens
  1. 1The client did not provide an authentication token in the request metadata.
  2. 2The provided authentication token is invalid, malformed, or expired.
  3. 3The server's authentication system is misconfigured or unable to validate the token.
How to reproduce

A client makes an RPC call without attaching the required authentication token to the request metadata.

trigger — this will error
trigger — this will error
// Client makes a call without credentials
try {
  // No metadata with auth token is provided
  await client.getSensitiveData(request);
} catch (e) {
  // e.code will be grpc.status.UNAUTHENTICATED
}

expected output

StatusCode.UNAUTHENTICATED: The request does not have valid authentication credentials for the operation

Fix 1

Attach Authentication Token to Metadata

WHEN When the client has an authentication token.

Attach Authentication Token to Metadata
const metadata = new grpc.Metadata();
metadata.add('authorization', "Bearer " + getAuthToken());

await client.getSensitiveData(request, metadata);

Why this works

gRPC uses metadata to pass request-scoped information like authentication tokens. The server will look for this token to authenticate the user.

Fix 2

Refresh Expired Token

WHEN When the provided token is expired.

Refresh Expired Token
try {
  await client.getSensitiveData(request, metadata);
} catch (e) {
  if (e.code === grpc.status.UNAUTHENTICATED) {
    // Token is likely expired, get a new one.
    const newToken = await authService.refreshToken();
    const newMetadata = new grpc.Metadata();
    newMetadata.add('authorization', "Bearer " + newToken);
    // Retry the request with the new token.
    return await client.getSensitiveData(request, newMetadata);
  }
}

Why this works

Authentication tokens have a limited lifetime. Implement a flow to refresh them when they expire and then retry the original request.

What not to do

✕ Retry the request without valid credentials

The server will reject every unauthenticated request. The client must obtain and provide valid credentials before retrying.

Sources

Content generated with AI assistance and reviewed for accuracy. Found an error? hello@errcodes.dev

← All gRPC errors