gRPC status 16: UNAUTHENTICATED

Usual causes

• No authorization metadata was sent.
• The token has expired, or was issued for another environment.
• The metadata key or format is wrong, such as a missing Bearer prefix.
• Mutual TLS is required and no client certificate was presented.

What to check

1. The metadata actually sent: key authorization, value Bearer <token>. gRPC metadata keys are lowercase.
2. The token's expiry and audience.
3. For mTLS, that the client certificate and key are configured and signed by a CA the server trusts.

Not to be confused with

Valid credentials without the right to do something get PERMISSION_DENIED.

What it looks like

A typical error, as a Go client prints it: rpc error: code = Unauthenticated desc = invalid token: token is expired

Retry, and the HTTP equivalent