{"record":{"id":"0a0ae45e23f8b0ac","repo":"hashicorp/terraform","slug":"failed-to-retrieve-credentials-for-s-s","errorCode":null,"errorMessage":"failed to retrieve credentials for %s: %s","messagePattern":"failed to retrieve credentials for (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/getproviders/registry_source.go","lineNumber":144,"sourceCode":"\tcase *disco.ErrVersionNotSupported:\n\t\treturn nil, ErrHostNoProviders{\n\t\t\tHostname:        hostname,\n\t\t\tHasOtherVersion: true,\n\t\t}\n\tdefault:\n\t\treturn nil, ErrHostUnreachable{\n\t\t\tHostname: hostname,\n\t\t\tWrapped:  err,\n\t\t}\n\t}\n\n\t// Check if we have credentials configured for this hostname.\n\tcreds, err := s.services.CredentialsForHost(hostname)\n\tif err != nil {\n\t\t// This indicates that a credentials helper failed, which means we\n\t\t// can't do anything better than just pass through the helper's\n\t\t// own error message.\n\t\treturn nil, fmt.Errorf(\"failed to retrieve credentials for %s: %s\", hostname, err)\n\t}\n\n\treturn newRegistryClient(url, creds), nil\n}\n\nfunc (s *RegistrySource) ForDisplay(provider addrs.Provider) string {\n\treturn fmt.Sprintf(\"registry %s\", provider.Hostname.ForDisplay())\n}\n","sourceCodeStart":126,"sourceCodeEnd":153,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/registry_source.go#L126-L153","documentation":"Returned by RegistrySource.registryClient (internal/getproviders/registry_source.go:144) when the credentials lookup for a registry hostname fails. The host has been discovered successfully and the providers.v1 service URL resolved, but calling s.services.CredentialsForHost(hostname) returned a non-nil error, meaning a configured credentials helper (or built-in credentials source) errored rather than producing a token. The message passes through the helper's own error verbatim as the second %s.","triggerScenarios":"A terraform init / provider download against a private/alternative registry hostname whose credentials helper plugin (defined in ~/.terraformrc cli_credentials CustomCommand) exits non-zero, returns malformed output, or cannot run; or a host where the credentials source is configured but the underlying token store (e.g. an expired OAuth/credential file) is unreadable.","commonSituations":"Misconfigured credentials_helper executable path, helper binary not on PATH, helper returning invalid JSON, expired tokens, permission errors reading ~/.terraform.d/credentials, or switching to a Terraform Enterprise/private registry without provisioning credentials. Also appears in CI where the helper is absent but hostname expects auth.","solutions":["Read the trailing helper error (%s) verbatim first; it identifies the failing credentials source.","Verify the credentials_helper executable in ~/.terraformrc exists, is executable, and is on PATH; run it manually with the get/getenv action to reproduce.","If using a private registry, set a token via TF_TOKEN_<hostname> env var or terraform login <hostname> for the affected host.","Check file permissions on ~/.terraform.d/ and any token files; ensure the helper process can read them.","For CI, ensure the same credentials source available locally is provisioned (env vars / helper binary) in the runner."],"exampleFix":"// before (~/.terraformrc)\ncredentials_helper \"tfe\" { args = [\"/wrong/path/helper\"] }\n// terraform init -> failed to retrieve credentials for app.terraform.io: exec: ...: no such file\n\n// after\ncredentials_helper \"tfe\" { args = [\"/usr/local/bin/credential-helper\"] }\n// or bypass helper:\nexport TF_TOKEN_app.terraform.io=<token>","handlingStrategy":"try-catch","validationCode":"// Before constructing the source, probe the credentials helper:\nfunc credentialsAvailable(services *disco.Disco, hostname svchost.Hostname) error {\n    host, err := services.Discover(hostname)\n    if err != nil { return err }\n    if _, err := host.ServiceURL(\"providers.v1\"); err != nil { return err }\n    // CredentialsForHost is the call that fails at line 144\n    if _, err := services.CredentialsForHost(hostname); err != nil {\n        return fmt.Errorf(\"credentials for %s unavailable: %w\", hostname, err)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// Treat registry/credential failures as retryable-or-fixable, surface the helper error:\nversions, _, err := src.AvailableVersions(ctx, provider)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to retrieve credentials for\") {\n        return fmt.Errorf(\"fix credentials for %s: %w\", provider.Hostname, err)\n    }\n    return err\n}","preventionTips":["Prefer TF_TOKEN_<hostname> env vars over helper plugins in CI for fewer moving parts.","Smoke-test the credentials_helper binary in isolation before terraform init.","Pin the helper version and store its config in version control.","Log hostname + helper error together so the failing host is obvious."],"tags":["registry","credentials","provider","authentication","terraform-init"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}