{"record":{"id":"795fa4864d595c4b","repo":"hashicorp/terraform","slug":"failed-to-create-api-client-s","errorCode":null,"errorMessage":"Failed to create API client: %s","messagePattern":"Failed to create API client: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/command/login.go","lineNumber":657,"sourceCode":"\t\tId:     \"token\",\n\t\tQuery:  fmt.Sprintf(\"Token for %s:\", hostname.ForDisplay()),\n\t\tSecret: true,\n\t})\n\tif err != nil {\n\t\tdiags := diags.Append(fmt.Errorf(\"Failed to retrieve token: %s\", err))\n\t\treturn \"\", diags\n\t}\n\n\ttoken = strings.TrimSpace(token)\n\tcfg := &tfe.Config{\n\t\tAddress:  service.String(),\n\t\tBasePath: service.Path,\n\t\tToken:    token,\n\t\tHeaders:  make(http.Header),\n\t}\n\tclient, err := tfe.NewClient(cfg)\n\tif err != nil {\n\t\tdiags = diags.Append(fmt.Errorf(\"Failed to create API client: %s\", err))\n\t\treturn \"\", diags\n\t}\n\tuser, err := client.Users.ReadCurrent(context.Background())\n\tif err == tfe.ErrUnauthorized {\n\t\tdiags = diags.Append(fmt.Errorf(\"Token is invalid: %s\", err))\n\t\treturn \"\", diags\n\t} else if err != nil {\n\t\tdiags = diags.Append(fmt.Errorf(\"Failed to retrieve user account details: %s\", err))\n\t\treturn \"\", diags\n\t}\n\tc.Ui.Output(fmt.Sprintf(c.Colorize().Color(\"\\nRetrieved token for user [bold]%s[reset]\\n\"), user.Username))\n\n\treturn svcauth.HostCredentialsToken(token), nil\n}\n\nfunc (c *LoginCommand) interactiveContextConsent(hostname svchost.Hostname, grantType disco.OAuthGrantType, credsCtx *loginCredentialsContext) (bool, tfdiags.Diagnostics) {\n\tvar diags tfdiags.Diagnostics\n\tmechanism := \"OAuth\"","sourceCodeStart":639,"sourceCodeEnd":675,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/command/login.go#L639-L675","documentation":"Thrown by the browser token login flow when constructing the TFE API client (tfe.NewClient) with the pasted token fails. The %s carries the client construction error. This is a local validation step before the token is even used to read the user account.","triggerScenarios":"Produced when tfe.NewClient(cfg) returns a non-nil error after the user pastes a token during `terraform login`. Triggered when the service address/base-path configuration is invalid or the tfe client cannot be initialized for the resolved service URL.","commonSituations":"Malformed service URL discovered via the host's .well-known/terraform.json, an empty/garbage token that violates client validation, or a TFE/Terraform Enterprise installation whose base path/Address is misconfigured. Rarely hit because NewClient does minimal validation.","solutions":["Verify the hostname resolves to a valid TFC/TFE service (open the service URL in a browser).","Check the host's /.well-known/terraform.json service discovery returns sane tfe/v2 endpoints.","Re-run `terraform login` ensuring you pasted a complete, non-empty token.","Upgrade the Terraform CLI (bundled tfe client) in case NewClient validation changed."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Validate the resolved service URL before constructing the TFE client.\nu, err := url.Parse(service.String())\nif err != nil || u.Scheme == \"\" || u.Host == \"\" {\n    return fmt.Errorf(\"invalid service URL %q for login\", service.String())\n}","typeGuard":null,"tryCatchPattern":"if _, err := tfe.NewClient(cfg); err != nil {\n    // Local client construction failed — verify the service URL and token are well-formed.\n    return err\n}","preventionTips":["Verify the host's /.well-known/terraform.json returns a valid tfe/v2 service endpoint before login.","Ensure the pasted token is non-empty and well-formed.","Keep the Terraform CLI updated so the bundled tfe client stays compatible."],"tags":["terraform","login","tfe-client","configuration"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}