40160: Client lacks the required capability

The API key or token used by the client isn't assigned the capability required for the operation — for example publishing, subscribing, or reading history on a channel, or listing channels and connections.

What you should do

If the client authenticates with an API key, assign the capability the operation needs to that key. If it authenticates with a token, update the code that issues tokens so they include that capability.

A client using an API key picks up the change on its next connection or request, though an existing connection keeps its capabilities until it reconnects. A client using a token keeps the capabilities baked into that token until it is refreshed — reconnecting with the same cached token will not help. If that delay matters, your application needs to trigger the affected clients to reconnect (for an API key) or refresh their token.

Why it happens

Every operation requires a particular capability on the channel or resource it targets, and this error is raised when that capability isn't assigned to the API key or token the client used. Common cases:

• Publishing or subscribing to a channel without the publish or subscribe capability.
• Retrieving a channel's history without the history capability.
• Entering presence on a channel without the presence capability.

What you'll see

The error is reported with code 40160 and HTTP status 401. The wording depends on the operation — the generic form is operation not permitted with provided capability, and more specific variants name the capability or resource involved, such as Unauthorized to publish to channel or Listing channels requires the channel-metadata capability.