{"record":{"id":"5280b0fed5c7b060","repo":"hashicorp/terraform","slug":"failed-to-determine-request-credentials-s","errorCode":null,"errorMessage":"failed to determine request credentials: %s","messagePattern":"failed to determine request credentials: (.+?)","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/getproviders/http_mirror_source.go","lineNumber":341,"sourceCode":"// produced the returned response, possibly after following some redirects.\nfunc (s *HTTPMirrorSource) get(ctx context.Context, relativePath string) (statusCode int, body io.ReadCloser, finalURL *url.URL, error error) {\n\tendpointPath, err := url.Parse(relativePath)\n\tif err != nil {\n\t\t// Should never happen because the caller should validate all of the\n\t\t// components it's including in the path.\n\t\treturn 0, nil, nil, err\n\t}\n\tendpointURL := s.baseURL.ResolveReference(endpointPath)\n\n\treq, err := retryablehttp.NewRequest(\"GET\", endpointURL.String(), nil)\n\tif err != nil {\n\t\treturn 0, nil, endpointURL, err\n\t}\n\treq = req.WithContext(ctx)\n\treq.Request.Header.Set(terraformVersionHeader, version.String())\n\tcreds, err := s.mirrorHostCredentials()\n\tif err != nil {\n\t\treturn 0, nil, endpointURL, fmt.Errorf(\"failed to determine request credentials: %s\", err)\n\t}\n\tif creds != nil {\n\t\t// Note that if the initial requests gets redirected elsewhere\n\t\t// then the credentials will still be included in the new request,\n\t\t// even if they are on a different hostname. This is intentional\n\t\t// and consistent with how we handle credentials for other\n\t\t// Terraform-native services, because the user model is to configure\n\t\t// credentials for the \"friendly hostname\" they configured, not for\n\t\t// whatever hostname ends up ultimately serving the request as an\n\t\t// implementation detail.\n\t\tcreds.PrepareRequest(req.Request)\n\t}\n\n\tresp, err := s.httpClient.Do(req)\n\tif err != nil {\n\t\treturn 0, nil, endpointURL, err\n\t}\n\tdefer func() {","sourceCodeStart":323,"sourceCodeEnd":359,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/getproviders/http_mirror_source.go#L323-L359","documentation":"At the start of each GET, get() calls mirrorHostCredentials() to load any host credentials. If that lookup fails (e.g. because the base URL host is invalid, producing the 889 error) it is wrapped with this message. It is a credentials-resolution failure, not an HTTP failure — the request was never sent.","triggerScenarios":"Any mirror request when the base URL hostname is invalid and a credentials source is configured, or when the credentials source itself returns an error from ForHost. The request is aborted before dialing.","commonSituations":"Invalid mirror hostname combined with a creds block; a credentials helper/plugin that errors for the mirror host; misconfigured base URL port.","solutions":["Fix the mirror base URL hostname (see the wrapped error, often the 889 IDNA failure).","Verify the credentials source / helper returns cleanly for the mirror host.","Remove the creds block for the host if none is needed, to isolate the cause."],"exampleFix":"# before\ncredentials \"tf_mirror.local\" { token = \"...\" }  # host won't normalize\nprovider_installation { network_mirror { url = \"https://tf_mirror.local/\" } }\n\n# after\ncredentials \"tf-mirror.local\" { token = \"...\" }\nprovider_installation { network_mirror { url = \"https://tf-mirror.local/\" } }","handlingStrategy":"validation","validationCode":"// Resolve mirror credentials once at startup, before any request.\nhost, err := svchost.FromURL(mirrorURL)\nif err != nil { return fmt.Errorf(\"bad mirror host: %w\", err) }\nif creds != nil { if _, err := creds.ForHost(host); err != nil { return err } }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate the mirror URL host before constructing HTTPMirrorSource.","Test the credentials helper against the mirror host in isolation.","Keep credentials and URL hostname spellings identical."],"tags":["config","credentials","mirror","hostname"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}