On our nRF Cloud account/team "petakara", TWO independent authentication
surfaces reject valid credentials:
1. REST API: every generated API key returns HTTP 401
{"message":"No API Key found for token. Cannot continue.","code":40100}
2. Device (nRF9151) nRF Cloud CoAP: connection reaches the endpoint with a
valid DTLS session and network time, but nrf_cloud_coap_connect() returns
-13 (EACCES); transport logs "Error sending CoAP request: -22".
The device is claimed to the account and the portal shows "Device identity
has been securely authenticated." So the portal/session side works, but the
device-facing and REST-key auth backends do not. This looks like an
account/team backend activation issue rather than a client mistake.
--- ISSUE 1: REST API KEY (40100) -------------------------------------------
Request (Authorization header verified correct via curl -v):
GET api.nrfcloud.com/.../devices
Authorization: Bearer <API_KEY>
Response:
HTTP/2 401
{"message":"No API Key found for token. Cannot continue.","code":40100}
- Tried THREE separate keys, each freshly generated / regenerated from
User Account -> Team Details -> API Key. All return 40100.
- GET /v1/account returns 401 {"code":1004,"message":"Missing or invalid
Authorization header"} with the same Bearer header.
- The Authorization header is confirmed transmitted correctly (curl -v shows
"> Authorization: Bearer <key>").
- No unresolved incident shown on the nRF Cloud status page at the time.
--- ISSUE 2: DEVICE nRF CLOUD CoAP (-13 / EACCES) ---------------------------
Firmware built on NCS 3.4 with nrf_cloud_coap (CONFIG_NRF_CLOUD=y,
CONFIG_NRF_CLOUD_COAP=y, CONFIG_NRF_CLOUD_CLIENT_ID_SRC_INTERNAL_UUID=y,
CONFIG_MODEM_JWT=y). Runtime log over SoftSIM/LTE-M:
net: LTE connected (reg status 5)
main: network time: 2026-07-17T14:04:53Z (valid time)
main: nrf_cloud_coap_init -> 0 (OK)
nrf_cloud_coap_transport: Error sending CoAP request: -22
main: nrf_cloud_coap_connect -> -13 (EACCES)
- The device's modem keystore sec_tag 16842753 contains CA (type 0),
client cert (type 1), and private key (type 2) — factory-provisioned.
- The device was onboarded to the account by claiming its attestation token
(AT%ATTESTTOKEN) in the nRF Cloud portal; portal reports the identity as
"securely authenticated".
- DTLS + time succeed; only the nRF Cloud auth/CoAP step is rejected.
--- WHAT WE'VE RULED OUT ----------------------------------------------------
- Wrong auth scheme: docs confirm Bearer + api.nrfcloud.com/v1; verified.
- Bad key copy: three regenerated keys, verbose-confirmed transmission.
- Client time: device has valid network time before the CoAP auth.
- Connectivity: LTE data path works (third-party HTTPS POST returns 200).
- Client identity mismatch: client ID = internal UUID = the claimed device.
--- QUESTIONS / REQUEST -----------------------------------------------------
1. Why does every API key for team "petakara" return 40100 "No API Key found
for token"? Is REST API access not activated for this team, or is there a
backend provisioning step pending on the account?
2. Why is the claimed device's nRF Cloud CoAP auth rejected with -13 (EACCES)
despite the portal showing "securely authenticated"? Does the device need
account-specific credentials provisioned (vs. the factory cert), and if so
why does the portal claim not surface that?
3. Please activate/repair API + device auth for this team, or advise the
exact remaining onboarding step.
