Element X requests /_matrix/client/unstable/org.matrix.msc4143/rtc/transports without access token and fails with MISSING_MATRIX_RTC_TRANSPORT

[ElefanD]

Steps to reproduce

1. Use a self-hosted Synapse 1.150.0 homeserver configured for MatrixRTC with LiveKit and lk-jwt-service.
2. Configure /.well-known/matrix/client with org.matrix.msc4143.rtc_foci pointing to the LiveKit JWT service.
3. Enable in Synapse:
   • experimental_features.msc3266_enabled: true
   • experimental_features.msc4222_enabled: true
   • experimental_features.msc4143_enabled: true
   • matrix_rtc.transports with type: livekit and the correct livekit_service_url
4. Sign in to Element X Android on this homeserver.
5. Open a DM or room and try to start a call.
6. Watch Synapse logs during the attempt.

Outcome

What did you expect?

Element X should successfully discover the MatrixRTC transport and start the call flow, or at minimum request the rtc/transports endpoint with the user's access token.

What happened instead?

Element X shows that the server is not configured to work with Element Call and fails with:

MISSING_MATRIX_RTC_TRANSPORT

In Synapse logs, Element X requests:

GET /_matrix/client/unstable/org.matrix.msc4143/rtc/transports

without an access token, receives:

401 Missing access token

and then proceeds to request an OpenID token afterwards.

The same rtc/transports endpoint works correctly when called manually with a valid bearer access token, returning:

{"rtc_transports":[{"type":"livekit","livekit_service_url":"https://site.com/livekit/jwt"}]}

So the server-side endpoint exists and works, but Element X appears to call it unauthenticated.

Relevant Synapse log lines:

Element X:
GET /_matrix/client/unstable/org.matrix.msc4143/rtc/transports -> 401 Missing access token
User-Agent: Element X/26.03.3 (...)

Then:
POST /_matrix/client/v3/user/@Stive:site.com/openid/request_token -> 200

Manual verification with bearer token:
GET /_matrix/client/unstable/org.matrix.msc4143/rtc/transports -> 200
{"rtc_transports":[{"type":"livekit","livekit_service_url":"https://site.com/livekit/jwt"}]}

Your phone model

Samsung SM-S938B

Operating system version

Android 16

Application version and app store

Element X 26.03.3

Homeserver

Self-hosted Synapse 1.150.0 on site.com with LiveKit 1.10.1 and lk-jwt-service 0.4.1

Will you send logs?

Yes

Are you willing to provide a PR?

No

[Susurrus]

You sure it's not a server misconfiguration, as that's what others have found when reporting this, like in #6485

[ElefanD]

You sure it's not a server misconfiguration, as that's what others have found when reporting this, like in #6485

I moved the JWT service from path-based proxying to a dedicated domain:

https://jwt.site.com

I updated both:

• /.well-known/matrix/client
• Synapse matrix_rtc.transports

Manual verification works:

• rtc/transports returns 200 with a valid bearer token
• it now returns the new URL https://jwt.site.com

But the behavior is unchanged.

Both Element Web and Element X still request:

GET /_matrix/client/unstable/org.matrix.msc4143/rtc/transports

without an access token, receive 401 Missing access token, and only then request an OpenID token.

Relevant logs:

Chrome:
GET ... rtc/transports -> 401
POST ... openid/request_token -> 200

Element X:
GET ... rtc/transports -> 401
POST ... openid/request_token -> 200

So moving JWT service to a dedicated domain did not fix it.

[ElefanD]

I found the root cause on my side.

The problem was not Element X, not LiveKit, and not the JWT service URL.

My self-hosted setup was missing a proper public reverse proxy for the homeserver on the standard Matrix HTTPS port 8448.

After adding this nginx block, calls started working:

server {
    listen IP:8448 ssl http2;
    server_name site.com;

    ssl_certificate /etc/letsencrypt/live/site.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/site.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    location /_matrix {
        proxy_pass http://127.0.0.1:8008;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto https;
        proxy_buffering off;
        client_max_body_size 100M;
    }
}

So the issue was caused by my incomplete homeserver exposure: /_matrix was working via 443 for some checks, but the homeserver was not properly exposed on 8448.

After publishing Synapse correctly on 8448, MatrixRTC calls started working.

Sorry for the noise — this turned out to be a server-side misconfiguration in my setup.

[NoX-programer]

Yes, the Element desktop and also web clients are also makes this request without authorization. However, there will be very cool if developers fix the Element clients so that all this works without opening port 8448, so that Synapse services can be "hidden" in subdomains and its existence cannot be easily detected.