NotAllowedError: Permission denied (getUserMedia)

The page asked for camera or microphone and the browser refused before any media flowed. No tracks, no preview — often a permission, secure-context, or Permissions-Policy problem.

Typical messages

DOMException: Permission denied
NotAllowedError: Permission denied by system
NotAllowedError: The request is not allowed by the user agent or the platform
// Chrome site settings: Camera → Block
// Safari: Preferences → Websites → Camera

Related names: NotFoundError (no device), NotReadableError (device in use / OS busy), OverconstrainedError (constraints too tight), SecurityError (insecure context).

Checklist

1. Secure context — navigator.mediaDevices requires https:// or http://localhost / 127.0.0.1. Plain http://192.168.… on a phone will deny. Use TLS or a tunnel for device tests.
2. User gesture — call getUserMedia from a click/tap handler the first time. Auto-calling on page load is blocked or ignored in modern browsers.
3. Previously blocked — the user (or you while testing) chose Block. Reset via the padlock / site settings; browsers do not show a prompt again until reset.
4. Permissions-Policy / Feature-Policy — response header or iframe attribute may disable camera/microphone:

   Permissions-Policy: camera=(), microphone=()   # blocks everything
   # iframe embed needs:
   <iframe allow="camera; microphone; display-capture" src="…">

   Cross-origin embeds need both the policy and explicit allow.
5. OS-level privacy — macOS/Windows/iOS can deny the whole browser. Check System Settings → Privacy → Camera / Microphone for Chrome/Firefox/Safari/Edge.
6. In-use device — another app holds an exclusive lock → often NotReadableError, not NotAllowedError. Close Zoom/Teams/OBS and retry.
7. Constraints — exact width/facingMode that no camera meets → OverconstrainedError. Loosen constraints; enumerate devices after permission with enumerateDevices.

Minimal pattern

btn.onclick = async () => {
  try {
    const stream = await navigator.mediaDevices.getUserMedia({
      audio: true,
      video: { facingMode: "user" },
    });
    video.srcObject = stream;
  } catch (err) {
    if (err.name === "NotAllowedError") {
      // show how to re-enable in site settings
    } else if (err.name === "NotFoundError") {
      // no camera/mic attached
    } else {
      console.error(err.name, err.message);
    }
  }
};

After permission succeeds

• Attach tracks to an RTCPeerConnection for calls; networking failures then show up as ICE failed.
• Thin upload pipes still make you look blurry to others — see why video calls go blurry.
• Stop tracks with track.stop() when leaving the page so the OS privacy light turns off.

Not the same as

• WebRTC ICE failed — permission worked; network path did not.
• WebSocket connection failed — signalling channel, not camera.
• connect-src CSP — fetch/WebSocket targets blocked by Content-Security-Policy (different API).

Related

WebRTC ICE failed · WebSocket connection failed · Mixed Content blocked · frame-ancestors / iframe · Wirebook: video-call compression

Questions

Published 6 November 2026.