{"record":{"id":"6e5441018c74c08a","repo":"netbirdio/netbird","slug":"failed-to-create-auth-client-v-6e5441","errorCode":null,"errorMessage":"failed to create auth client: %v","messagePattern":"failed to create auth client: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/internal/auth/oauth.go","lineNumber":91,"sourceCode":"func NewOAuthFlow(ctx context.Context, config *profilemanager.Config, isUnixDesktopClient bool, forceDeviceCodeFlow bool, hint string) (OAuthFlow, error) {\n\tif shouldUseDeviceFlow(forceDeviceCodeFlow, isUnixDesktopClient) {\n\t\treturn authenticateWithDeviceCodeFlow(ctx, config, hint)\n\t}\n\n\tpkceFlow, err := authenticateWithPKCEFlow(ctx, config, hint)\n\tif err != nil {\n\t\tlog.Debugf(\"failed to initialize pkce authentication with error: %v\\n\", err)\n\t\tlog.Debug(\"falling back to device code flow\")\n\t\treturn authenticateWithDeviceCodeFlow(ctx, config, hint)\n\t}\n\treturn pkceFlow, nil\n}\n\n// authenticateWithPKCEFlow initializes the Proof Key for Code Exchange flow auth flow\nfunc authenticateWithPKCEFlow(ctx context.Context, config *profilemanager.Config, hint string) (OAuthFlow, error) {\n\tauthClient, err := NewAuth(ctx, config.PrivateKey, config.ManagementURL, config)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create auth client: %v\", err)\n\t}\n\tdefer authClient.Close()\n\n\tpkceFlowInfo, err := authClient.getPKCEFlow(authClient.client)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"getting pkce authorization flow info failed with error: %v\", err)\n\t}\n\n\tif hint != \"\" {\n\t\tpkceFlowInfo.SetLoginHint(hint)\n\t}\n\n\treturn pkceFlowInfo, nil\n}\n\n// authenticateWithDeviceCodeFlow initializes the Device Code auth Flow\nfunc authenticateWithDeviceCodeFlow(ctx context.Context, config *profilemanager.Config, hint string) (OAuthFlow, error) {\n\tauthClient, err := NewAuth(ctx, config.PrivateKey, config.ManagementURL, config)","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/internal/auth/oauth.go#L73-L109","documentation":"Returned by authenticateWithPKCEFlow when NewAuth fails to build the management gRPC client before fetching PKCE provider info (client/internal/auth/oauth.go:89-92). NewAuth dials config.ManagementURL with the host's private key, so failures are connectivity or identity level: management unreachable, TLS handshake failure, or login/registration rejected. Note: NewOAuthFlow catches this error, logs it at debug level, and falls back to the device code flow, so end users normally see it only as a debug log line preceding a device-flow attempt (or its sibling, error 927).","triggerScenarios":"NewAuth(ctx, config.PrivateKey, config.ManagementURL, config) fails: management service down or URL wrong, DNS resolution failure, firewall blocking the gRPC port (default 443/33073), TLS certificate mismatch, or the host key not being accepted by management.","commonSituations":"Self-hosted management behind a load balancer with an expired cert; wrong --management-url after a migration; client clock skew breaking TLS; host not yet registered so the key login fails.","solutions":["Verify the management URL is reachable: curl -v https://<management-url> from the same machine","Check DNS and firewall rules for the management gRPC port","Inspect the management server logs for the rejected login from this host key","If TLS is the issue, ensure the host trusts the management certificate (system CA store or embedded roots)"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Check management reachability before attempting login\nfunc managementReachable(rawURL string) error {\n\tu, err := url.Parse(rawURL)\n\tif err != nil {\n\t\treturn err\n\t}\n\t_, err = net.DialTimeout(\"tcp\", u.Host, 5*time.Second)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"management %s not reachable: %w\", u.Host, err)\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"flow, err := auth.NewOAuthFlow(ctx, cfg, isDesktop, false, hint)\nif err != nil {\n\t// PKCE failures like this fall back to device flow; the surfaced error comes from there.\n\t// Inspect debug logs to see which stage failed.","preventionTips":["Pre-flight the management URL/port with a TCP dial before login attempts","Keep management certificates valid and trusted by clients","Remember this error is usually swallowed by the device-flow fallback - chase it in debug logs"],"tags":["grpc","management","connectivity","pkce","tls"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}