{"record":{"id":"623b3bbe3e94c554","repo":"pulumi/pulumi","slug":"unauthorized-no-credentials-provided-or-are-inval","errorCode":null,"errorMessage":"Unauthorized: No credentials provided or are invalid.","messagePattern":"Unauthorized: No credentials provided or are invalid\\.","errorType":"error_code","errorClass":"ErrUnauthorized","httpStatus":401,"severity":"error","filePath":"pkg/backend/httpstate/backend.go","lineNumber":80,"sourceCode":"\t\"github.com/pulumi/pulumi/sdk/v3/go/common/env\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/common/promise\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/common/resource/config\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/common/slice\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/common/tokens\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/common/util/agentdetect\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/common/util/cmdutil\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/common/util/contract\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/common/util/logging\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/common/util/result\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/common/util/retry\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/common/workspace\"\n\t\"github.com/pulumi/pulumi/sdk/v3/go/property\"\n\n\t\"go.opentelemetry.io/otel\"\n\toteltrace \"go.opentelemetry.io/otel/trace\"\n)\n\nvar ErrUnauthorized = errors.New(\"Unauthorized: No credentials provided or are invalid.\")\n\ntype agentCredentialUseContextKey struct{}\n\ntype agentCredentialUse struct {\n\tsync.Mutex\n\tcloudURLs map[string]bool\n}\n\n// ContextWithAgentCredentialUse returns a context that tracks shared temporary\n// agent credential use for one CLI command.\nfunc ContextWithAgentCredentialUse(ctx context.Context) context.Context {\n\treturn context.WithValue(ctx, agentCredentialUseContextKey{}, &agentCredentialUse{\n\t\tcloudURLs: map[string]bool{},\n\t})\n}\n\nfunc agentCredentialUseFromContext(ctx context.Context) *agentCredentialUse {\n\tuse, _ := ctx.Value(agentCredentialUseContextKey{}).(*agentCredentialUse)","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/pkg/backend/httpstate/backend.go#L62-L98","documentation":"ErrUnauthorized is the Pulumi Cloud backend's sentinel error indicating no valid credentials were presented to the service. Code paths use errors.Is(err, ErrUnauthorized) to detect when login/signup is required.","triggerScenarios":"Calling httpstate backend operations (login, account validation, agent credential flows) with an empty/invalid/expired PULUMI_ACCESS_TOKEN or no stored credentials for the cloud URL; TestCurrent* and validateStoredAccount paths hit it when the API rejects the token.","commonSituations":"Never running `pulumi login`; PULUMI_ACCESS_TOKEN env var unset, typo'd, or revoked; token expired on CI machines; switching cloud URLs (PULUMI_CLOUD_URL) where no account is stored.","solutions":["Run `pulumi login` to authenticate interactively","Set a valid PULUMI_ACCESS_TOKEN (create one at the Pulumi Cloud console) for headless/CI use","Check the credentials file (~/.pulumi/credentials.json) for stale entries for the cloud URL and re-login","Verify you are pointing at the intended cloud URL (default https://api.pulumi.com)"],"exampleFix":"// before (CI)\nrun: pulumi up\n// after\nenv:\n  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}\nrun: pulumi up","handlingStrategy":"fallback","validationCode":"// Go caller check before using the backend\nif os.Getenv(\"PULUMI_ACCESS_TOKEN\") == \"\" {\n\tif _, err := os.Stat(filepath.Join(home, \".pulumi\", \"credentials.json\")); err != nil {\n\t\treturn ErrUnauthorized // prompt for login first\n\t}\n}","typeGuard":null,"tryCatchPattern":"_, err := httpstate.New(ctx, d, cloudURL, project, insecure)\nif errors.Is(err, backend.ErrUnauthorized) {\n\t// run `pulumi login` or set PULUMI_ACCESS_TOKEN, then retry\n}","preventionTips":["Run `pulumi login` before first use on a machine","Set PULUMI_ACCESS_TOKEN in CI secrets; rotate tokens before expiry","Match the cloud URL to where your token was issued"],"tags":["authentication","httpstate","pulumi-cloud"],"backgroundTag":"unauthorized-missing-credentials","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}