onelifevibe

Platform API error

missing_credentials

missing_credentials is the HTTP 401 error returned when a keyed OneLifeVibe Platform API call arrives with no API key at all.

Updated November 6, 2026

HTTP status
401
Code
missing_credentials
API
Platform API v1

Returned when

What to do

Example answer

HTTP/1.1 401
content-type: application/json

{
  "error": {
    "code": "missing_credentials",
    "message": "Send an API key."
  }
}

Related errors

What it means

The Platform API received a request to an endpoint that requires a key, and the request carried no credentials. Nothing was rejected as wrong; nothing was checked. There was simply no Authorization: Bearer olvp_… header and no X-API-Key header on the request.

The response uses the standard error shape: {"error":{"code":"…","message":"…","hint":"…"}}. For this code the message reads "Send an API key." and the hint points you at the fix. The code field holds missing_credentials and the HTTP status is 401.

Treat the code as the contract. It is stable across versions, while the message and hint text can change. Match on missing_credentials, never on the message string.

Why you are seeing it

This error is returned when a call to a keyed endpoint arrives with no Authorization: Bearer olvp_… header and no X-API-Key header. That covers a few common situations: a first request built before credentials were wired in, a client that drops custom headers, or a local script where the environment variable holding the key resolved to an empty value, so the header was never set.

It also shows up when a request is sent to a keyed endpoint through a path you did not expect, such as a quick test from a browser or an HTTP tool where you forgot to add the header. The server does not guess; if the header is absent, the answer is 401 with this code.

Because the credential is entirely absent, missing_credentials is distinct from invalid_credentials, which covers a key that was sent but not accepted, and from key_revoked, which covers a key that no longer works. Those are worth checking when a header is present and the request still fails.

How to fix it

Send the key on the request. Either header works: Authorization: Bearer olvp_… or X-API-Key: olvp_…. Pick one and use it consistently across your integration.

If you do not have a key yet, create one in the console at https://onelifevibe.com/platform/. Store it outside your source tree, load it at runtime, and confirm the value is present before you build the request — an empty variable is the most common way this error appears in code that looks correct.

After adding the header, send the same request again. If the response changes to a different code such as invalid_credentials or key_revoked, the header is now being read and you can work through that specific case.

Handling it in code

Check for HTTP 401 and parse the error object. Compare error.code to missing_credentials to distinguish it from the credential problems that mean the key was sent but is unusable. Keep credentials in a single place in your client so every outbound request gets the same header, rather than setting it per call site where it is easy to miss.

For a 401 with this code, retrying unchanged will not help — the request needs a header it did not have. Fix the configuration or surface the error to whoever can supply a key. Do not log the key value itself when you add diagnostics around the header.

A small guard before dispatch pays off: read the key, assert it is a non-empty string, and fail locally with a clear message if it is not. That turns a round trip into an immediate, obvious error, and keeps this code reserved for requests that genuinely left without credentials.

Questions

What is the difference between missing_credentials and invalid_credentials?

missing_credentials means no API key was sent at all: no Authorization: Bearer olvp_… header and no X-API-Key header. invalid_credentials means a key was sent but was not accepted. Both return HTTP 401, so match on the code field to tell them apart.

Which header should I use for the Platform API?

Either Authorization: Bearer olvp_… or X-API-Key: olvp_… satisfies a keyed endpoint. You can create a key in the console at https://onelifevibe.com/platform/. Choose one header and send it on every keyed request.

Why did I get missing_credentials when my code sets the header?

The header was not on the request the server received. The usual cause is an environment variable that resolved to an empty value, so the header was never added, or a client or proxy that stripped it. Check the outgoing request and confirm the key value is present before the call is built.

Keys, plans and usage live in the console: rotate keys, add webhook endpoints, see the last 30 days.

Open the console Plans

Written from the OneLifeVibe tool registry and platform configuration, and checked automatically before publishing. Something wrong? Tell us.