{"record":{"id":"0225a2a2a5547733","repo":"netbirdio/netbird","slug":"failed-to-create-auth-client-v-0225a2","errorCode":null,"errorMessage":"failed to create auth client: %v","messagePattern":"failed to create auth client: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/login.go","lineNumber":375,"sourceCode":"\t\treturn fmt.Errorf(\"waiting sso login failed with: %v\", err)\n\t}\n\n\tif resp.Email != \"\" {\n\t\terr = pm.SetActiveProfileState(&profilemanager.ProfileState{\n\t\t\tEmail: resp.Email,\n\t\t})\n\t\tif err != nil {\n\t\t\tlog.Warnf(\"failed to set active profile email: %v\", err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc foregroundLogin(ctx context.Context, cmd *cobra.Command, config *profilemanager.Config, setupKey string, profileID profilemanager.ID) error {\n\tauthClient, err := auth.NewAuth(ctx, config.PrivateKey, config.ManagementURL, config)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create auth client: %v\", err)\n\t}\n\tdefer authClient.Close()\n\n\tneedsLogin, err := authClient.IsLoginRequired(ctx)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"check login required: %v\", err)\n\t}\n\n\tjwtToken := \"\"\n\tif setupKey == \"\" && needsLogin {\n\t\ttokenInfo, err := foregroundGetTokenInfo(ctx, cmd, config, profileID)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"interactive sso login failed: %v\", err)\n\t\t}\n\t\tjwtToken = tokenInfo.GetTokenToUse()\n\t}\n\n\terr, _ = authClient.Login(ctx, setupKey, jwtToken)","sourceCodeStart":357,"sourceCodeEnd":393,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/login.go#L357-L393","documentation":"auth.NewAuth could not construct the client from the profile config: parsing config.ManagementURL failed (bad scheme, invalid host characters such as underscores, unparseable URL), the stored private key could not be loaded or is invalid, or TLS/PKI material could not be initialized. This fails before any network login attempt is made.","triggerScenarios":"Management URL like netbird_mgmt.corp:443 (underscore host) or missing https:// scheme; corrupted or deleted private key file referenced by the profile; key file unreadable due to permissions; misconfigured NB_ env overriding the management address.","commonSituations":"Typos when creating the profile ('netbird profile create --management-url ...'); Config copied between machines without the key material; Hostnames with underscores, which Go's url parsing rejects for hosts; Corporate proxies rewriting or blocking the initial connection setup","solutions":["Verify the management URL format: scheme + host + optional port (https://api.netbird.io:443), no underscores in the host","Recreate the profile with a corrected URL ('netbird profile create') so a fresh key pair is generated","Check that the private key file exists and is readable by the invoking user","Confirm NB_MANAGEMENT_URL / related env vars are not overriding the profile with a bad value"],"exampleFix":"# before\n$ netbird profile create --management-url netbird_mgmt.corp:443\n$ netbird login\nError: failed to create auth client: ...\n\n# after: valid scheme, no underscore host\n$ netbird profile create --management-url https://netbird-mgmt.corp:443\n$ netbird login","handlingStrategy":"validation","validationCode":"// Validate URL shape and key readability before constructing the client\nu, err := url.Parse(config.ManagementURL)\nif err != nil || (u.Scheme != \"http\" && u.Scheme != \"https\") || u.Host == \"\" || strings.Contains(u.Hostname(), \"_\") {\n    return fmt.Errorf(\"invalid management URL %q\", config.ManagementURL)\n}\nif _, err := os.Stat(config.PrivateKey); err != nil {\n    return fmt.Errorf(\"private key file unavailable: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"authClient, err := auth.NewAuth(ctx, config.PrivateKey, config.ManagementURL, config)\nif err != nil {\n    return fmt.Errorf(\"failed to create auth client: %w\", err)\n}","preventionTips":["Never use underscores in management hostnames; hyphens are safe","Create profiles with a fully qualified https://host:port URL","When copying profiles between machines, copy the key material too or expect recreation"],"tags":["auth","config","url-parsing","tls","netbird"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}