{"record":{"id":"2a6555ae0bb17e1c","repo":"hashicorp/nomad","slug":"missing-login-token","errorCode":null,"errorMessage":"missing login token","messagePattern":"missing login token","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/acl.go","lineNumber":2430,"sourceCode":"\n\t// LoginToken is the 3rd party token that we use to exchange for Nomad ACL\n\t// Token in order to authenticate. This is a required parameter.\n\tLoginToken string\n\n\tWriteRequest\n}\n\n// Validate ensures the request object contains all the required fields in\n// order to complete the authentication flow.\nfunc (a *ACLLoginRequest) Validate() error {\n\n\tvar mErr multierror.Error\n\n\tif a.AuthMethodName == \"\" {\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"missing auth method name\"))\n\t}\n\tif a.LoginToken == \"\" {\n\t\tmErr.Errors = append(mErr.Errors, errors.New(\"missing login token\"))\n\t}\n\treturn mErr.ErrorOrNil()\n}\n\n// ACLCreateClientIntroductionTokenRequest is the request object used within the ACL\n// client introduction RPC handler. This is used to generate a JWT token that\n// can be used to register a new client node into the cluster.\ntype ACLCreateClientIntroductionTokenRequest struct {\n\n\t// TTL is the requested TTL for the identity token. This is an optional\n\t// parameter and if not set, defaults to the server defined default TTL.\n\tTTL time.Duration\n\n\t// NodeName is the name of the node that is being introduced. This is added\n\t// to the token as a claim when present, but is optional.\n\tNodeName string\n\n\t// NodePool is the name of the node pool that this node belongs to. This is","sourceCodeStart":2412,"sourceCodeEnd":2448,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/acl.go#L2412-L2448","documentation":"This error is returned by ACLToken's exchange (Login) request validation in nomad/structs/acl.go. When a client performs an ACL Login against an auth method (JWT/OIDC login), the request must carry the JWT obtained from the identity provider. Nomad raises \"missing login token\" when the LoginToken field of the request is empty. It is a client-side input validation error designed to fail fast before any RPC is processed.","triggerScenarios":"Calling the ACL.Login RPC (or `nomad login` / the HTTP POST /v1/acl/token endpoints for login) with an ACLLoginRequest whose LoginToken field is the empty string. Typical causes: reading the JWT from a file/env var that is unset, or constructing the request programmatically and forgetting to set LoginToken.","commonSituations":"Automating `nomad login` in CI where the OIDC/JWT token variable was not exported; passing the wrong struct field (e.g. setting AuthMethodName but leaving LoginToken empty); using an API client wrapper that drops the token field on serialization.","solutions":["Obtain a JWT from your auth provider and set LoginToken on the ACLLoginRequest (or pass it to `nomad login <jwt>`) before issuing the login request.","Verify the token source (env var, file path, cloud metadata) actually produced a non-empty string at the call site.","Pre-validate the request client-side: if AuthMethodName is set, assert LoginToken != \"\" before invoking Login."],"exampleFix":"// before\nreq := &structs.ACLLoginRequest{\n    AuthMethodName: \"auth0\",\n    // LoginToken not set\n}\ntok, err := aclClient.Login(a, req)\n\n// after\nreq := &structs.ACLLoginRequest{\n    AuthMethodName: \"auth0\",\n    LoginToken:     os.Getenv(\"OIDC_JWT\"),\n}\nif req.LoginToken == \"\" {\n    return fmt.Errorf(\"no JWT available for login\")\n}\ntok, err := aclClient.Login(a, req)","handlingStrategy":"validation","validationCode":"if req.AuthMethodName == \"\" || req.LoginToken == \"\" {\n    return fmt.Errorf(\"login requires both auth_method_name and login_token\")\n}","typeGuard":null,"tryCatchPattern":"if err := aclClient.Login(a, req); err != nil {\n    if strings.Contains(err.Error(), \"missing login token\") {\n        return fmt.Errorf(\"no JWT supplied: re-run with `nomad login <jwt>`\")\n    }\n    return err\n}","preventionTips":["Read the JWT from a checked source and fail fast if the env var/file is empty before calling Login.","Never construct ACLLoginRequest with only AuthMethodName populated.","Wrap `nomad login` calls in CI with a token-presence assertion step."],"tags":["nomad","acl","authentication","jwt"],"backgroundTag":"missing-auth-token","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}