{"record":{"id":"18af662c1a1a4a0c","repo":"docker/cli","slug":"failed-to-get-tokens-w","errorCode":null,"errorMessage":"failed to get tokens: %w","messagePattern":"failed to get tokens: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/oauth/api/api.go","lineNumber":172,"sourceCode":"\t}\n\tt.Reset(d)\n}\n\n// getDeviceToken calls the token endpoint of Auth0 and returns the response.\nfunc (a API) getDeviceToken(ctx context.Context, state State) (TokenResponse, error) {\n\tctx, cancel := context.WithTimeout(ctx, 1*time.Minute)\n\tdefer cancel()\n\n\tdata := url.Values{\n\t\t\"client_id\":   {a.ClientID},\n\t\t\"grant_type\":  {\"urn:ietf:params:oauth:grant-type:device_code\"},\n\t\t\"device_code\": {state.DeviceCode},\n\t}\n\toauthTokenURL := a.TenantURL + \"/oauth/token\"\n\n\tresp, err := postForm(ctx, oauthTokenURL, strings.NewReader(data.Encode()))\n\tif err != nil {\n\t\treturn TokenResponse{}, fmt.Errorf(\"failed to get tokens: %w\", err)\n\t}\n\tdefer func() {\n\t\t_ = resp.Body.Close()\n\t}()\n\n\t// this endpoint returns a 403 with an `authorization_pending` error until the\n\t// user has authenticated, so we don't check the status code here and instead\n\t// decode the response and check for the error.\n\tvar res TokenResponse\n\terr = json.NewDecoder(resp.Body).Decode(&res)\n\tif err != nil {\n\t\treturn res, fmt.Errorf(\"failed to decode response: %w\", err)\n\t}\n\n\treturn res, nil\n}\n\n// RevokeToken revokes a refresh token with the tenant so that it can no longer","sourceCodeStart":154,"sourceCodeEnd":190,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/internal/oauth/api/api.go#L154-L190","documentation":"Returned by getDeviceToken() when the HTTP POST (postForm) to <TenantURL>/oauth/token fails at the transport layer (DNS, TLS, connection refused, timeout — the call has a 1 minute context timeout). The %w wraps the underlying net/http error. This is the device-code grant token exchange step of the Docker Hub OAuth device flow.","triggerScenarios":"Calling the Hub OAuth device-flow token endpoint and the request never completes: no network, corporate proxy blocking login.docker.com / *.auth0.com, TLS interception, or the 1-minute context deadline elapsing.","commonSituations":"Offline or firewalled environments; corporate MITM proxies without trusted CA; misconfigured TenantURL; clock skew breaking TLS; transient outage of the Auth0 tenant.","solutions":["Verify network connectivity to the OAuth tenant host (curl -v <TenantURL>/oauth/token).","Configure proxy / trusted CA for the CLI (HTTP_PROXY/HTTPS_PROXY and system trust store).","Retry — the failure is wrapped and the device flow can be re-initiated.","Check system clock sync (NTP) to avoid TLS handshake failures."],"exampleFix":"# before: no proxy, blocked\ndocker login\n# after\nexport HTTPS_PROXY=http://corp-proxy:3128\nexport SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt\ndocker login","handlingStrategy":"retry","validationCode":"// validate reachability before starting the device flow\nif err := probeOAuthTenant(ctx, tenantURL); err != nil { return err }","typeGuard":null,"tryCatchPattern":"var ue *url.Error\nif errors.As(err, &ue) { /* network/transport — retry with backoff */ }\nif errors.Is(err, context.DeadlineExceeded) { /* extend timeout or re-init flow */ }","preventionTips":["Pre-flight a TCP/TLS probe to the OAuth tenant host.","Configure trusted proxy + CA before login.","Keep system clock synced via NTP."],"tags":["oauth","docker-hub","network","device-flow","tls","auth"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}