{"record":{"id":"1179ef569daf6d4e","repo":"cloudflare/cloudflared","slug":"error-while-creating-backend-client-1179ef","errorCode":null,"errorMessage":"error while creating backend client","messagePattern":"error while creating backend client","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/tunnel/subcommand_context_vnets.go","lineNumber":13,"sourceCode":"package tunnel\n\nimport (\n\t\"github.com/google/uuid\"\n\t\"github.com/pkg/errors\"\n\n\t\"github.com/cloudflare/cloudflared/cfapi\"\n)\n\nfunc (sc *subcommandContext) addVirtualNetwork(newVnet cfapi.NewVirtualNetwork) (cfapi.VirtualNetwork, error) {\n\tclient, err := sc.client()\n\tif err != nil {\n\t\treturn cfapi.VirtualNetwork{}, errors.Wrap(err, noClientMsg)\n\t}\n\treturn client.CreateVirtualNetwork(newVnet)\n}\n\nfunc (sc *subcommandContext) listVirtualNetworks(filter *cfapi.VnetFilter) ([]*cfapi.VirtualNetwork, error) {\n\tclient, err := sc.client()\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, noClientMsg)\n\t}\n\treturn client.ListVirtualNetworks(filter)\n}\n\nfunc (sc *subcommandContext) deleteVirtualNetwork(vnetId uuid.UUID, force bool) error {\n\tclient, err := sc.client()\n\tif err != nil {\n\t\treturn errors.Wrap(err, noClientMsg)\n\t}\n\treturn client.DeleteVirtualNetwork(vnetId, force)","sourceCodeStart":1,"sourceCodeEnd":31,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/tunnel/subcommand_context_vnets.go#L1-L31","documentation":"`addVirtualNetwork` wraps the error from `subcommandContext.client()` with the shared noClientMsg — the Tunnel Store API client could not be built, so virtual network creation never reaches the API. Same root cause as all noClientMsg errors: origin certificate problems or invalid API URL.","triggerScenarios":"`cloudflared tunnel vnet add <name>` when credentials.Read fails (missing cert.pem / bad --origincert) or cred.Client() construction fails (bad --api-url, malformed cert).","commonSituations":"Provisioning vnets from automation without a logged-in cert; cert.pem not mounted in the container; wrong --origincert path; broken --api-url override.","solutions":["Run `cloudflared tunnel login` or provide --origincert pointing at a valid cert.pem","Verify the cert file exists and is readable at the configured path","Check --api-url is correct if overridden","Confirm automation uses absolute cert paths and correct HOME"],"exampleFix":"# before\ncloudflared tunnel vnet add corp-vnet   # fails: no backend client\n# after\ncloudflared tunnel login\ncloudflared tunnel vnet add corp-vnet --origincert /etc/cloudflared/cert.pem","handlingStrategy":"validation","validationCode":"if info, err := os.Stat(certPath); err != nil || info.IsDir() {\n    return errors.New(\"origin cert required for `tunnel vnet add`\")\n}","typeGuard":null,"tryCatchPattern":"vnet, err := addVirtualNetwork(newVnet)\nif err != nil && strings.Contains(err.Error(), noClientMsg) {\n    // fix credentials and retry\n}","preventionTips":["Provision cert.pem in the environment before vnet provisioning","Use absolute --origincert in CI/CD pipelines","Keep cert.pem mode 0600 and owned by the executing user","Check the wrapped error (errors.Cause) to distinguish cert vs URL problems"],"tags":["go","cli","cloudflare-api","authentication"],"backgroundTag":"missing-credentials","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}