Element X cannot make calls (MISSING_MATRIX_RTC_TRANSPORT) despite fully configured LiveKit

[Yason24]

Description:

I'm trying to set up Element X with my self-hosted Matrix server. Text messaging works, but calls fail with error: MISSING_MATRIX_RTC_TRANSPORT

Server configuration:

• Synapse: 1.150.0
• MAS: Matrix Authentication Service
• LiveKit: 1.10.0
• JWT Service: lk-jwt-service 0.4.1
• Domain: matrix.rdk-invest.ru:8450

What works:

• ✅ curl -k https://matrix.rdk-invest.ru:8450/_matrix/client/versions → JSON
• ✅ curl -k https://matrix.rdk-invest.ru:8450/livekit/ → OK
• ✅ curl -k https://matrix.rdk-invest.ru:8450/livekit/jwt/healthz → empty (not 404)
• ✅ .well-known/matrix/client contains rtc_foci section
• ✅ All experimental flags enabled (msc3266_enabled, msc4222_enabled, msc4140_enabled, msc4143_enabled)
• ✅ livekit_jwt_sso configured in homeserver.yaml

.well-known/matrix/client:

json

{
  "m.homeserver": {"base_url": "https://matrix.rdk-invest.ru:8450"},
  "org.matrix.msc4143.rtc_foci": [{
    "type": "livekit",
    "livekit_service_url": "https://matrix.rdk-invest.ru:8450/livekit",
    "livekit_jwt_service_url": "https://matrix.rdk-invest.ru:8450/livekit/jwt"
  }]
}

homeserver.yaml excerpt:

yaml

experimental_features:
  msc3266_enabled: true
  msc4222_enabled: true
  msc4140_enabled: true
  msc4143_enabled: true

livekit_jwt_sso:
  enabled: true
  livekit_jwt_sso_url: "https://matrix.rdk-invest.ru:8450/livekit/jwt/sfu/get"
  livekit_key: "matrix"
  livekit_secret: "S02oQ4mqLVb9SIC6hwhfOVQVHXQg2f5f"
  livekit_sfu_url: "https://matrix.rdk-invest.ru:8450/livekit/sfu"

Issue:
When I try to make a call in Element X:

• No requests appear in JWT Service logs
• No "livekit/jwt" mentions in Synapse logs

Question:
Why doesn't Synapse forward call requests to LiveKit/JWT Service? What additional configuration is needed?

[devastgh]

You well-known must reside on https, and port 443, using the exact domain that is written in your server_name in the homeserver.yaml as described in the documentation.

[Yason24]

Thank you for your input! 🙏

I understand your point, but according to the Matrix specification, non‑standard ports are allowed -- the client should discover the server via the .well-known endpoint, which can be served on any port.

My .well-known is correctly served at:

text

https://matrix.rdk-invest.ru:8450/.well-known/matrix/client

and it returns the expected JSON with the rtc_foci section:

json

{
  "m.homeserver": {
    "base_url": "https://matrix.rdk-invest.ru:8450"
  },
  "org.matrix.msc2965.authentication": {
    "issuer": "https://auth.rdk-invest.ru:8450",
    "account": "https://auth.rdk-invest.ru:8450/account/"
  },
  "org.matrix.msc4143.rtc_foci": [
    {
      "type": "livekit",
      "livekit_service_url": "https://matrix.rdk-invest.ru:8450/livekit/jwt"
    }
  ]
}

The server_name in my homeserver.yaml is matrix.rdk-invest.ru (without the port), and the public_baseurl is set to https://matrix.rdk-invest.ru:8450.

The issue is that Element X does not send the Authorization header when calling the MSC4143 endpoint (/_matrix/client/unstable/org.matrix.msc4143/rtc/transports).

All other authenticated endpoints (like /sync, /profile, /messages) work fine and include the header.

I've confirmed this by checking the server logs:

text

GET /_matrix/client/unstable/org.matrix.msc4143/rtc/transports HTTP/1.1
Host: matrix.rdk-invest.ru:8450
User-Agent: Element X/26.03.3 (iPhone 15 Plus; iOS 26.3.1; Scale/3.00)
// No Authorization header present

When I call the same endpoint manually with a valid token, it returns 200 OK:

bash

curl -X GET "https://matrix.rdk-invest.ru:8450/_matrix/client/unstable/org.matrix.msc4143/rtc/transports" \
  -H "Authorization: Bearer <valid_token>"

-> Returns {} (200 OK)

So the server is configured correctly. The problem is clearly on the client side.

---

Additional context from the Matrix specification:

According to the Matrix Client-Server API specification, the .well-known endpoint can be served on any port:

The client should first check `https:///.well-known/matrix/client`. If this returns a JSON object with a `m.homeserver` base_url, the client should use that URL. The base_url may include a port number.

This means that non‑standard ports are explicitly supported.

---

Related issues:
This issue has also been reported in:

• Element Call #3790
• Element Call #3825

From the discussion in those issues, the problem is that Element X does not properly authenticate the MSC4143 endpoint, while other endpoints work fine. This is a client‑side bug that affects self‑hosted servers, especially those using non‑standard ports.

What I've tried:

• ✅ Verified .well-known is correct and accessible
• ✅ Confirmed LiveKit and JWT service are running
• ✅ Verified all experimental flags are enabled
• ✅ Checked that other authenticated endpoints work
• ✅ Reinstalled Element X, cleared cache
• ✅ Restarted all services

The server is fully configured according to the official documentation. The issue persists.

Question:
Do you have any suggestions for making this work with a non‑standard port? Or is this a known limitation in Element X that should be addressed?

Any help would be greatly appreciated! 🙌

[Yason24]

Update: I've tried moving .well-known to port 443, as suggested. The server is now fully accessible on the standard HTTPS port. All endpoints work, LiveKit is accessible, and the .well-known file is correct.

However, the issue remains exactly the same. Element X still shows MISSING_MATRIX_RTC_TRANSPORT, and server logs confirm that Element X does not send the Authorization header for the MSC4143 endpoint. Other authenticated endpoints work fine.

This experiment confirms that the problem is not related to the port. It is a client-side bug in Element X -- the app does not attempt to use LiveKit at all.

Please prioritize fixing this. The server is configured perfectly according to the official documentation, but Element X remains unusable for calls on self-hosted servers.

[devastgh]

Please prioritize fixing this.

Only you can fix your own config... and AI won't help you in that... reading the documentation will. Run the tester . Currently, your ssl cert on the well-known is not valid for your server_name : I don't know if the server name is matrix.rdk-invest.ru or rdk-invest.ru , but ther cert is for yason24.myasustor.com

Testing server matrix.rdk-invest.ru
𐄂 SSL error connecting to https://matrix.rdk-invest.ru/.well-known/matrix/server: HTTPSConnectionPool(host='matrix.rdk-invest.ru', port=443): Max retries exceeded with url: /.well-known/matrix/server (Caused by SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'matrix.rdk-invest.ru'. (_ssl.c:1029)")))

[Yason24]

Thank you for your help! 🙏

I've successfully obtained valid SSL certificates for both matrix.rdk-invest.ru and auth.rdk-invest.ru from Let's Encrypt. The server is now fully configured:

• ✅ Valid SSL certificate for matrix.rdk-invest.ru
• ✅ .well-known/matrix/client correctly served on port 443
• ✅ .well-known/matrix/server created with m.server: "matrix.rdk-invest.ru:443"
• ✅ LiveKit accessible: https://matrix.rdk-invest.ru/livekit/ -> OK
• ✅ JWT service accessible: https://matrix.rdk-invest.ru/livekit/jwt/healthz -> empty response
• ✅ All experimental flags enabled in Synapse
• ✅ livekit_jwt_sso correctly configured

The issue persists: Element X still shows MISSING_MATRIX_RTC_TRANSPORT when trying to make a call.

Server logs confirm the same problem as before:

text

GET /_matrix/client/unstable/org.matrix.msc4143/rtc/transports HTTP/1.1
Host: matrix.rdk-invest.ru
User-Agent: Element X/26.03.3 (iPhone 15 Plus; iOS 26.3.1; Scale/3.00)
// No Authorization header present

All other authenticated endpoints work fine and include the Authorization: Bearer ... header.

I've now tested with:

• ✅ Port 8450 (non‑standard) -- doesn't work
• ✅ Port 443 (standard) -- doesn't work
• ✅ Valid SSL certificates -- doesn't work
• ✅ Proper .well-known files -- doesn't work

The server is configured according to the official documentation. The only remaining issue is that Element X does not send the Authorization header for the MSC4143 endpoint.

This is a client‑side bug. I've already reported it in:

• Element Call #3825
• Element Call #3790

Please prioritize fixing this so Element X can work with self-hosted servers. Thank you! 🙏

[etareduction]

Please prioritize fixing this.

Only you can fix your own config... and AI won't help you in that... reading the documentation will. Run the tester . Currently, your ssl cert on the well-known is not valid for your server_name : I don't know if the server name is matrix.rdk-invest.ru or rdk-invest.ru , but ther cert is for yason24.myasustor.com

Testing server matrix.rdk-invest.ru
𐄂 SSL error connecting to https://matrix.rdk-invest.ru/.well-known/matrix/server: HTTPSConnectionPool(host='matrix.rdk-invest.ru', port=443): Max retries exceeded with url: /.well-known/matrix/server (Caused by SSLError(SSLCertVerificationError(1, "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'matrix.rdk-invest.ru'. (_ssl.c:1029)")))

I'm having the same issue now and i ran the tests you linked and got the following results:

Testing server my.example.com
  Federation url: https://my.example.com:443
✔ Server well-known exists
✔ Client well-known has proper CORS header
  Client url: https://my.example.com
  Adding livekit service URL: https://calls.my.example.com/livekit/jwt
✔ Server version: Synapse (1.150.0)
✔ Federation API endpoints seem to work fine
✔ Client API endpoints seem to work fine
✔ Server oauth metadata endpoint exists
  QR code login is disabled (MSC 4108)
  Public room directory is disabled
✔ MatrixRTC SFU configured
✔ JWTauth healthz responds
✔ jwt /get_token without auth returns 405, good.
  jwt: no credentials passed, not trying authed requests
✔ MatrixRTC configured and delayed events work
✔ Room summaries (MSC3266) (unstable) support
✔ Direct registration and guest access forbidden per se 👍

I tried fixing the issue without any AI but also came to a conclusion that it is not a configuration issue.

[dobwide]

Having the same issue.
New installation via ansible playbook. The same result.

[Fla95100]

Same here. Existing installation stopped working. Livekit connection test is passed but still I receive the error.

[devastgh]

Same here. Existing installation stopped working. Livekit connection test is passed but still I receive the error.

I tested today on my self-hosted synapse (every software component up to date), and for me everything works properly. Calling from/to element x android, both federated and local. I cannot test with ios.
ps: this tester does not fully test the functionality. It's just a quick sanity test, using all publicly available data. If the test passes, that usually means synapse/jwt config is ok. At that point i would look at the livekit config and logs.

[Yason24]

Thanks for the input, @devastgh. I'm glad it's working for you, but that doesn't mean there isn't a client-side bug that appears under certain conditions.

I've done extensive debugging on my own server and captured the Element X logs. Here's what they prove:

1. My server configuration is 100% correct. The app logs in, syncs, loads rooms, and fetches profiles without any issues. The problem is NOT on the server side. 2. The issue is purely client-side.

When starting a call, the app fails BEFORE even attempting to contact my LiveKit server. The log shows this CallKit error:

text

ERROR elementx: Failed toggling call microphone with error: Error Domain=com.apple.CallKit.error.requesttransaction Code=4 "(null)"

3. What Code 4 actually means. This is CXErrorCodeRequestTransactionErrorUnknownCallUUID. It happens when the app sends a command to iOS (like starting or ending a call) with a call UUID that the system no longer tracks. This is a known iOS-level issue, especially on iOS 18 where callservicesd can be unstable.

Conclusion: The bug is NOT in the hardware (your device works, mine works) and NOT in the server config. It's in how Element X interacts with CallKit on specific iOS versions or devices.

I've already opened a separate issue with full logs and provided everything to the developers:

#3825 – Element X on iOS and Android doesn't send Authorization header for MSC4143 endpoint -> MISSING_MATRIX_RTC_TRANSPORT

You can find my detailed logs there, including the CallKit error. I'm waiting for the developers to release a fix.

[etareduction]

Same here. Existing installation stopped working. Livekit connection test is passed but still I receive the error.

I tested today on my self-hosted synapse (every software component up to date), and for me everything works properly. Calling from/to element x android, both federated and local. I cannot test with ios. ps: this tester does not fully test the functionality. It's just a quick sanity test, using all publicly available data. If the test passes, that usually means synapse/jwt config is ok. At that point i would look at the livekit config and logs.

Are you making the calls using Element X app or Element Classic? Is it on Android or IOS?

[Fla95100]

Same here. Existing installation stopped working. Livekit connection test is passed but still I receive the error.

I tested today on my self-hosted synapse (every software component up to date), and for me everything works properly. Calling from/to element x android, both federated and local. I cannot test with ios. ps: this tester does not fully test the functionality. It's just a quick sanity test, using all publicly available data. If the test passes, that usually means synapse/jwt config is ok. At that point i would look at the livekit config and logs.

Are you making the calls using Element X app or Element Classic? Is it on Android or IOS?

I am using Element X app on android.

[devastgh]

Are you making the calls using Element X app or Element Classic? Is it on Android or IOS?

I'm testing element x on android, and element web/desktop (basically the same). I cannot test element x on ios, as i don't have access to an apple device. Element classic cannot do element call at all, i'm not using that client.