---
title: "DF0036: RPC Call Rejected, Not Authorized"
description: "RPC call to \"{name}\" was rejected: the caller is not authorized."
canonical_url: "https://devfra.me/errors/df0036"
---
# DF0036: RPC Call Rejected, Not Authorized

> RPC call to "\{name}" was rejected: the caller is not authorized.

## Message

> RPC call to "`{name}`" was rejected: the caller is not authorized.

## Cause

An `authorize` gate (set directly or via an [`auth` handler](https://devfra.me/guide/security)) rejected the call: the session is untrusted and the method is not `anonymous:`-prefixed (see `isAnonymousRpcMethod`).

## Example

```ts
// Handshake methods stay reachable before auth completes…
await client.call('anonymous:devframe:auth', { authToken: '', ua, origin })

// …but trusted methods throw until the handshake succeeds.
await client.call('some-plugin:do-something') // ✗ throws DF0036
```

## Fix

- Complete the auth handshake before calling a trusted method.
- Connect with a static/pre-shared token (`createInteractiveAuth`'s `clientAuthTokens`) for CI or shared machines.
- With a custom `authorize`, confirm it allows the method; it receives the method name and the session's `meta`.

## Source

- [`packages/devframe/src/node/rpc-core.ts`](https://github.com/devframes/devframe/blob/main/packages/devframe/src/node/rpc-core.ts): `createContextRpcServer`'s resolver throws this when `authorize`/`auth.authorize` rejects a call.


## Sitemap

See the full [sitemap](https://devfra.me/sitemap.md) for all pages.