{"record":{"id":"6ce49b675ef4f480","repo":"ory/hydra","slug":"failed-to-accept-user-code-request-s","errorCode":null,"errorMessage":"Failed to accept user code request: %s","messagePattern":"Failed to accept user code request: (.+?)","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"cmd/cmd_perform_device_flow.go","lineNumber":218,"sourceCode":"\tif err != nil {\n\t\thttp.Error(w, fmt.Sprintf(\"Failed to encode request body: %s\", err), http.StatusInternalServerError)\n\t\treturn\n\t}\n\treq, err := http.NewRequestWithContext(r.Context(), http.MethodPut, acceptURL, bytes.NewReader(body))\n\tif err != nil {\n\t\thttp.Error(w, fmt.Sprintf(\"Failed to create request: %s\", err), http.StatusInternalServerError)\n\t\treturn\n\t}\n\treq.Header.Set(\"Content-Type\", \"application/json\")\n\treq.Header.Set(\"Accept\", \"application/json\")\n\n\thc := cfg.HTTPClient\n\tif hc == nil {\n\t\thc = http.DefaultClient\n\t}\n\tres, err := hc.Do(req)\n\tif err != nil {\n\t\thttp.Error(w, fmt.Sprintf(\"Failed to accept user code request: %s\", err), http.StatusInternalServerError)\n\t\treturn\n\t}\n\tdefer res.Body.Close() //nolint:errcheck\n\traw, err := io.ReadAll(io.LimitReader(res.Body, 1<<20))\n\tif err != nil {\n\t\thttp.Error(w, fmt.Sprintf(\"Failed to read response: %s\", err), http.StatusInternalServerError)\n\t\treturn\n\t}\n\tif res.StatusCode != http.StatusOK {\n\t\thttp.Error(w, fmt.Sprintf(\"Failed to accept user code request: %s\", raw), http.StatusInternalServerError)\n\t\treturn\n\t}\n\tvar accepted struct {\n\t\tRedirectTo string `json:\"redirect_to\"`\n\t}\n\tif err := json.Unmarshal(raw, &accepted); err != nil || accepted.RedirectTo == \"\" {\n\t\thttp.Error(w, \"Malformed response from the accept endpoint\", http.StatusInternalServerError)\n\t\treturn","sourceCodeStart":200,"sourceCodeEnd":236,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/cmd/cmd_perform_device_flow.go#L200-L236","documentation":"Returned when the HTTP client fails to execute the PUT request to the admin device-accept endpoint (hc.Do(req) errors). This is a transport-level failure: the admin server was unreachable, TLS failed, DNS failed, the connection was reset, or the request context was canceled. The handler converts it into a 500 with the underlying error text.","triggerScenarios":"hc.Do(req) at cmd/cmd_perform_device_flow.go:218 returns a non-nil error while accepting the device challenge — connection refused (admin API not running on cfg.Servers[0].URL), DNS resolution failure, TLS certificate errors, proxy issues, or r.Context() canceled because the browser user abandoned the POST.","commonSituations":"Hydra admin port not exposed or wrong port in config; running the CLI against https with a self-signed cert; firewall/DNS issues; docker network misconfiguration where the admin URL points at localhost from another container; user closed the tab mid-request (context canceled).","solutions":["Verify cfg.Servers[0].URL points at the reachable Hydra ADMIN endpoint and the admin port is published/reachable from where the CLI runs.","Test connectivity directly: curl -X PUT '<acceptURL>' -d '{\"user_code\":\"...\"}' to reproduce and see the transport error.","If using self-signed TLS, fix the trust chain (install CA or configure the HTTPClient's TLS config) rather than disabling verification in production.","Retry transient network failures with backoff; surface context-canceled distinctly so users know the browser request was aborted."],"exampleFix":"// before\nres, err := hc.Do(req)\nif err != nil {\n\thttp.Error(w, fmt.Sprintf(\"Failed to accept user code request: %s\", err), http.StatusInternalServerError)\n\treturn\n}\n// after\nres, err := hc.Do(req)\nif err != nil {\n\tif errors.Is(err, context.Canceled) {\n\t\thttp.Error(w, \"Request canceled\", http.StatusRequestTimeout)\n\t\treturn\n\t}\n\tlogger.Errorf(\"device accept request failed: %v\", err)\n\thttp.Error(w, \"Admin endpoint unreachable\", http.StatusBadGateway)\n\treturn\n}","handlingStrategy":"retry","validationCode":"conn, err := net.DialTimeout(\"tcp\", hostPortFromURL(cfg.Servers[0].URL), 3*time.Second)\nif err != nil {\n\treturn fmt.Errorf(\"hydra admin unreachable at %s: %w\", cfg.Servers[0].URL, err)\n}\nconn.Close()","typeGuard":"func adminReachable(serverURL string, client *http.Client) bool {\n\tresp, err := client.Get(serverURL + \"/admin/health/ready\")\n\tif err != nil { return false }\n\tresp.Body.Close()\n\treturn resp.StatusCode < 500\n}","tryCatchPattern":"var res *http.Response\nerr := retry.Do(3, time.Second, func() error {\n\tvar e error\n\tres, e = hc.Do(req.Clone(ctx))\n\treturn e\n})\nif err != nil {\n\tif errors.Is(err, context.Canceled) { return err } // do not retry user aborts\n\thttp.Error(w, \"admin endpoint unreachable\", http.StatusBadGateway)\n\treturn\n}","preventionTips":["Health-check the admin endpoint before starting the device flow","Use absolute, verified admin URLs — remember admin and public ports differ in Hydra","Trust the CA used by the admin endpoint instead of skipping TLS verification","Distinguish context.Canceled from transport errors before retrying"],"tags":["network","http","hydra"],"backgroundTag":"connection-refused","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}