Troubleshooting
Start from what you see. Every error from Mubit names a code: find it under Mubit's errors.
Common problems
The call gets a 401, such as missing_key or invalid_key
Mubit refused the call's key. The error's code says why:
missing_key: the call carries no key. If your code readsMUBIT_API_KEY, set it in the shell that runs the code.invalid_key: copy the key again, or create a new one. Check the base URL against your console's Connect page.- A code that ends in
_refused: the call carries something other than your Mubit key, such as a provider key or a sign-in token, or your Mubit key in the wrong place. With the Anthropic SDKs, checkANTHROPIC_AUTH_TOKEN: unset it, or set it to your Mubit key. With Claude Code, unsetANTHROPIC_API_KEYinstead (see Coding tools). - No
middleware_gateway_errorin the error: your provider refused the provider key saved for this project. An admin checks it under Provider keys.
Sign-ins to Claude Pro or Max, ChatGPT or Codex can't be used. Use a Mubit key. See Key errors.
The call gets a 403, such as provider_key_missing
If the error's type is middleware_gateway_error, Mubit refused the call. Its code says why:
provider_key_missing: this project has no key for that provider. A provider the starter credit doesn't cover always needs your own key; the console names the providers it covers. An admin adds it under Provider keys, as Add a key shows.key_permission: the key is read-only. Use an Inference key.key_scope: the key isn't tied to one project. Use a key created in the project the calls are for.starter_credit_route: the starter credit doesn't serve that path. Add your own key for the provider.admin_path_refused: the path is an organization or admin endpoint. Call your provider directly for those.
Without middleware_gateway_error, your provider refused it: see Your provider's errors. See also Provider key errors and Key errors.
My call isn't in Requests
- The call didn't go through Mubit. Check that your client uses Mubit's base URL. An answer from Mubit carries the header
x-middleware-request-id. - The call asked Mubit not to keep it. A call sent with
x-middleware-store: false, or withx-middleware-record: metadataoroff, doesn't show in Requests. - Mubit refused it before calling your provider. A call refused for its key, its path or a missing provider key leaves no record, so it isn't in Requests. Read the error your app got. See Why a call isn't listed.
A call from a browser fails
Mubit's API answers no CORS preflight request, so a browser refuses to send the call. Call Mubit from your server. That also keeps your key off your users' devices.
A long call or stream stops
Mubit has time limits: 610 s for the provider to start its answer, 15 minutes with no part of the answer going to your app, and 60 minutes in all.
504 upstream_timeout: the provider didn't start its answer within 610 s. For long answers, stream: a stream starts as soon as the provider starts writing. Your SDK's own timeout (600 s by default for OpenAI and Anthropic) usually ends the wait first: raise it, or stream.- A stream that breaks off: it went 15 minutes without sending anything, or ran for 60 minutes. Make sure your app keeps reading the stream.
The call gets a 502, 503 or 504
503with the typemiddleware_gateway_error: wait the seconds inretry-after, then try again. Nothing was sent to your provider. A503with the typemiddleware_errorisno_provider_configured. Any other503is your provider's.502 upstream_unreachable: Mubit couldn't connect to your provider. Nothing was sent. Try again shortly.502 upstream_failed: the connection broke after the request started. Your provider may have the request, so Mubit doesn't send it again. Try again if a second call is safe for your app.504 upstream_timeout: see A long call or stream stops.
Calls on the starter credit are refused
The starter credit serves a set list of models, paths and options. Each refusal names what it doesn't serve: change the call as the message says, or add your own key for the provider under Provider keys. See Starter credit errors.
My SDK retries a call Mubit refused
Mubit sends x-should-retry: false on errors a retry won't fix, and retry-after on 429 and 503. SDKs that read these headers stop or wait. Your SDK owns retries: Mubit itself retries only a call it couldn't send at all. See Retries.
A task doesn't train, or an adapter isn't in Try models
Open the task in Tasks, or the adapter in Adapters, and read its status. Create your first adapter explains each one and what to do:
- What each test result means:
Passed,Below target,Malformed tool calls,Prompt onlyandNot tested. - Why a task is waiting or cannot train: the daily training limit, the pause between trainings, and too few or too long examples.
- Why an adapter is unavailable in Try models: the console's messages, such as
Not in Try models: prompt only, and what each one means.
Mubit's errors
Mubit's own errors use your provider's error format. Their type is middleware_gateway_error, and they name a code and the call's request ID. The one exception is no_provider_configured, under Path errors: its type is middleware_error. The API reference shows the format for each provider.
In the messages, {provider} is the provider's name, such as OpenAI or Anthropic. {upstream} is the provider's name, or this workspace's gateway. An ellipsis (…) marks text left out here.
Key errors
| Code | Status | Message | What to do |
|---|---|---|---|
missing_key | 401 | No API key was provided. Send your Mubit key where the provider's SDK sends its API key. | Pass your Mubit key to the client, or set MUBIT_API_KEY in the shell that runs your code. |
invalid_key | 401 | Incorrect API key provided. | The key is wrong, revoked or malformed, or the call carries two different Mubit keys. Copy the key again, or create a new one under Mubit keys. Check the base URL against your console's Connect page. |
wrong_region | 401 | Names the base URL to send the call to. | Use the base URL your console's Connect page shows. |
key_expired | 401 | This API key expired at {time}. Create a new key or rotate this one. | Create a new key, or ask an admin to rotate this one under Mubit keys. |
key_permission | 403 | This key's permission can't call a provider. Use an inference key of this project. | The key is read-only. An admin creates an Inference key under Mubit keys. |
key_scope | 403 | This key is not tied to one project. Use an inference key created for one project. | Use a key created in the project the calls are for. |
provider_key_refused | 401 | This is a provider API key, not a Mubit key. Send your Mubit key where your SDK sends its API key, and add the provider key under Provider keys in the console. | Send your Mubit key. Add the provider key under Provider keys. |
subscription_token_refused | 401 | This is a Claude subscription sign-in token (from a Claude login or claude setup-token), not a Mubit key. … | Claude Pro and Max sign-ins can't be used. Send your Mubit key. |
jwt_refused | 401 | This is a sign-in token (a JWT), not a Mubit key. … | Sign-ins such as ChatGPT and Codex logins can't be used. Send your Mubit key. |
oauth_token_refused | 401 | This is a Google OAuth token, not a Mubit key. Send your Mubit key where your SDK sends its API key. | Send your Mubit key in place of the Google sign-in. |
extra_credential_refused | 401 | This request carries a credential that is not a Mubit key beside your Mubit key. Send only the Mubit key. | Remove the other credential. With the Anthropic SDKs, unset ANTHROPIC_AUTH_TOKEN, or set it to your Mubit key. With Claude Code, unset ANTHROPIC_API_KEY instead (see Coding tools). |
middleware_key_refused | 401 | This request carries a Mubit key outside the places the gateway reads keys from. Send your Mubit key where your SDK sends its API key, and only there. | Send the key only in the key header for your provider. |
engine_unavailable | 503 | The gateway could not check this key just now. Try again shortly. | Wait the seconds in retry-after, then try again. |
Provider key errors
| Code | Status | Message | What to do |
|---|---|---|---|
provider_key_missing | 403 | This project has no {provider} key. Add one under Provider keys in the console. | Add the provider's key under Provider keys, as the Provider keys page shows. |
provider_region_unavailable | 403 | … Delete the key and add it again under Provider keys in the console. | Delete the provider's key under Provider keys, then add it again. |
key_store_unavailable | 503 | The gateway could not read this project's provider key just now. Try again shortly. | Wait the seconds in retry-after, then try again. |
Starter credit errors
These come only on calls the starter credit pays for.
| Code | Status | Message | What to do |
|---|---|---|---|
starter_credit_used_up | 402 | The starter credit on … {provider} key is used up. Add your own {provider} key under Provider keys in the console … | Add your own key for that provider under Provider keys. Your calls use it from then on. |
starter_credit_model | 400 | The starter credit serves these {provider} models on this route: … Name one of them as the model, or add your own {provider} key under Provider keys in the console to use another. | Use a model the message lists, or add your own key. |
starter_credit_route | 403 | This route is not available on the starter credit. Add your own {provider} key under Provider keys in the console to use it. | The starter credit serves fewer paths; Paths Mubit refuses lists them. Add your own key for other paths. |
starter_credit_tools | 400 | Tools billed apart from tokens (hosted web search, file search, code execution, image generation, hosted MCP), tool versions the starter credit does not list, and background mode are not available on the starter credit. … | Leave those tools and background mode out, or add your own key. |
starter_credit_option | 400 | Names one option the starter credit doesn't serve, and how to leave it out. | Change the call as the message says, or add your own key. |
starter_credit_body | 413, 408 or 400 | The request body … Add your own {provider} key under Provider keys in the console to send it as it is. | Change the body as the message says, or add your own key. Limits: 8 MiB, whole within 60 s, plain JSON. See Sizes. |
starter_credit_key_refused | 502 | {provider} refused the starter credit's key, so this call was not served. Add your own {provider} key under Provider keys in the console to go on. | Add your own key for that provider. |
starter_credit_busy | 429 | This project already has {n} calls in flight on the starter credit, its limit at once. Try again shortly, or add your own key under Provider keys in the console. | Wait the seconds in retry-after, or send fewer calls at once. |
starter_credit_unavailable | 503 | The gateway could not use this project's starter credit just now. Try again shortly. | Wait the seconds in retry-after, then try again. |
Path errors
| Code | Status | Message | What to do |
|---|---|---|---|
unknown_route | 404 | Unknown route. … | Use a path under one of the provider prefixes. |
unknown_provider | 404 | Unknown provider. The OpenAI-compatible providers this gateway serves at /compat/<provider>/v1 are: … | Put one of the services the message lists in the /compat path. |
admin_path_refused | 403 | Organization and admin endpoints are not available through this gateway. Call the provider directly. | Call your provider directly for organization and admin endpoints. |
invalid_path | 400 | The request path has a . or .. segment, a ;, a control character, or an escape that decodes again. | Send the path your provider documents, as it is. |
no_provider_configured | 503 | Says that this address makes no provider calls. Its type is middleware_error. | The call went to the console's address. Use the base URL your console's Connect page shows. |
Connection and capacity errors
| Code | Status | Message | What to do |
|---|---|---|---|
upstream_unreachable | 502 | Could not connect to {upstream}. Nothing was sent. Try again shortly. | Try again shortly. |
upstream_failed | 502 | The connection to {upstream} failed before it answered. | Your provider may have the request. Try again if a second call is safe for your app. |
upstream_redirect | 502 | {upstream} answered with a redirect (HTTP {status}). … | Check the path against your provider's API. Mubit doesn't follow redirects, so a retry gets the same answer. |
upstream_timeout | 504 | No answer from {upstream} within {seconds} s. | The provider didn't start its answer in time. For long answers, stream. |
gateway_overloaded | 503 | This gateway is at its connection limit. Nothing was sent. Try again shortly. | Wait the seconds in retry-after, then try again. |
gateway_draining | 503 | This gateway instance is shutting down. Nothing was sent. Try again. | Try again. Nothing was sent. |
Your provider's errors
Mubit passes your provider's answers back to your app, its errors included.
An error whose type is middleware_gateway_error or middleware_error came from Mubit. An error without either, on an answer that carries x-middleware-request-id, came from your provider as it sent it. An answer without that header didn't come through Mubit's API: check the base URL and try again.
Your provider's message says why. The usual causes:
| Status | What it means | What to do |
|---|---|---|
| 401 or 403 | Your provider refused the key. | An admin checks the provider's key under Provider keys. |
| 429 | Your provider account's limit was reached. | Check the limits on your provider account. |
| 400 | Your provider refused the request. | Read its message: it says why. |
| 404 | The model or path wasn't found. | Check the model ID, then send the call again. |
| 5xx | Your provider had a problem. | Try again shortly. |
| Problem | What to do |
|---|---|
| Your Gemini calls fail, and your Gemini key is on the free tier. | Google doesn't serve its free tier in some countries. Use a paid-tier Gemini key. |
Find a call's request ID
Each answer carries the call's ID in the x-middleware-request-id header. Mubit's own errors also carry it in their body. It starts with mreq_.
Requests shows how to read the header in Python, TypeScript and curl.
Requests shows its own ID for each call, under Details. It is not the request ID: see Find a call's request ID.
Get help
When you ask for help with a call, include:
- the call's request ID, from
x-middleware-request-id; - when you sent it, with your time zone;
- the status, the error's code and its message;
- the base URL and path, and the SDK you use, with its version.
Never send your Mubit key or a provider key.