{"record":{"id":"30c4a82192f9ea50","repo":"pulumi/pulumi","slug":"this-command-requires-logging-in-try-running-esc","errorCode":null,"errorMessage":"this command requires logging in; try running `esc login` first","messagePattern":"this command requires logging in; try running `esc login` first","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"pkg/cmd/esc/cli/client/client.go","lineNumber":1798,"sourceCode":"\t}\n\n\tif opts.GzipCompress {\n\t\t// If we're sending something that's gzipped, set that header too.\n\t\treq.Header.Set(\"Content-Encoding\", \"gzip\")\n\t}\n\n\tresp, err := doWithRetry(pc.httpClient, req, opts.RetryPolicy)\n\tif err != nil {\n\t\t// Don't wrap *apitype.ErrorResponse.\n\t\tif _, ok := err.(*apitype.ErrorResponse); ok {\n\t\t\treturn nil, err\n\t\t}\n\t\treturn nil, fmt.Errorf(\"performing HTTP request: %w\", err)\n\t}\n\n\t// Provide a better error if using an authenticated call without having logged in first.\n\tif resp.StatusCode == 401 && pc.apiToken == \"\" {\n\t\treturn nil, errors.New(\"this command requires logging in; try running `esc login` first\")\n\t}\n\n\t// Provide a better error if rate-limit is exceeded(429: Too Many Requests)\n\tif resp.StatusCode == 429 {\n\t\treturn nil, errors.New(\"esc: request rate-limit exceeded\")\n\t}\n\n\t// For 4xx and 5xx failures, attempt to provide better diagnostics about what may have gone wrong.\n\tif resp.StatusCode >= 400 && resp.StatusCode <= 599 {\n\t\t// 4xx and 5xx responses should be of type ErrorResponse. See if we can unmarshal as that\n\t\t// type, and if not just return the raw response text.\n\t\trespBody, err := io.ReadAll(resp.Body)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"API call failed (%s), could not read response: %w\", resp.Status, err)\n\t\t}\n\n\t\treqID := \"\"\n\t\tif resp.StatusCode >= 500 {","sourceCodeStart":1780,"sourceCodeEnd":1816,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/pkg/cmd/esc/cli/client/client.go#L1780-L1816","documentation":"The Pulumi ESC CLI client returns this error when an authenticated API call receives an HTTP 401 response while no API token is configured (pc.apiToken == \"\"). It is a friendlier replacement for a generic unauthorized error, telling the user they must authenticate with `esc login` before running commands that hit the Pulumi Cloud API.","triggerScenarios":"Any esc client call that goes through the HTTP request path when the server responds with status 401 and the client was constructed without an API token — e.g. running `esc env get`, `esc env set`, or `esc open` in a fresh environment or after credentials were cleared/rotated.","commonSituations":"Running ESC commands on a new machine or CI runner without logging in; PULUMI_ACCESS_KEY/token env vars unset or expired; token revoked server-side; using the wrong backend URL so stored credentials don't apply.","solutions":["Run `esc login` to authenticate and store an API token","Verify the token is available in your environment (e.g. PULUMI_ACCESS_KEY) and has not expired","Check you are pointing at the intended backend URL (PULUMI_BACKEND_URL / cloud URL) so existing credentials are used","Re-login if the token was revoked or rotated recently"],"exampleFix":"// before (CI without auth)\n- run: esc env get my-org/my-proj/my-env\n// after\n- run: esc login --auth-mode access-key\n- run: esc env get my-org/my-proj/my-env","handlingStrategy":"validation","validationCode":"// Go: check credentials before invoking esc client calls\nfunc ensureLoggedIn(client *escclient.Client) error {\n    if client == nil || !hasAPIToken() {\n        return errors.New(\"run `esc login` before running this command\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// Go\nref, err := client.GetEnvironment(ctx, org, proj, env)\nif err != nil {\n    if strings.Contains(err.Error(), \"requires logging in\") {\n        return fmt.Errorf(\"not logged in: run `esc login` first: %w\", err)\n    }\n    return err\n}","preventionTips":["Run `esc login` in every new machine/container/CI environment","Check token expiry and rotate before it lapses","Verify PULUMI_ACCESS_KEY or equivalent is exported in CI secrets"],"tags":["authentication","http-401","cli"],"backgroundTag":"not-authenticated-401","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}