{"record":{"id":"8a98599eabfbf9ab","repo":"multica-ai/multica","slug":"could-not-start-the-local-login-callback-server-u","errorCode":null,"errorMessage":"could not start the local login callback server (used to receive the browser sign-in); a firewall or another process may be blocking local ports: %w","messagePattern":"could not start the local login callback server \\(used to receive the browser sign-in\\); a firewall or another process may be blocking local ports: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/cmd/multica/cmd_auth.go","lineNumber":251,"sourceCode":"\t\treturn v4\n\t}\n\treturn local.IP\n}\n\nfunc runAuthLoginBrowser(cmd *cobra.Command) error {\n\tserverURL := resolveHumanServerURL(cmd)\n\tappURL := resolveAppURL(cmd)\n\n\tflagHost := callbackHostFlagValue(cmd)\n\tcallbackHost, bindAddr := resolveCallbackBinding(flagHost, serverURL, appURL, detectOutboundIP)\n\n\t// Pin to \"tcp4\" — a bare \"tcp\" on macOS can produce an IPv6-only socket\n\t// that IPv4 clients (including browsers resolving localhost → 127.0.0.1)\n\t// cannot reach. The callback URL is always an IPv4 literal or hostname,\n\t// so an IPv4 listener is what the browser actually needs.\n\tlistener, err := net.Listen(\"tcp4\", bindAddr+\":0\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"could not start the local login callback server (used to receive the browser sign-in); a firewall or another process may be blocking local ports: %w\", err)\n\t}\n\tdefer listener.Close()\n\n\tport := listener.Addr().(*net.TCPAddr).Port\n\tcallbackURL := fmt.Sprintf(\"http://%s:%d/callback\", callbackHost, port)\n\n\t// Generate a random state parameter for CSRF protection.\n\tstateBytes := make([]byte, 16)\n\tif _, err := rand.Read(stateBytes); err != nil {\n\t\treturn fmt.Errorf(\"failed to generate state: %w\", err)\n\t}\n\tstate := hex.EncodeToString(stateBytes)\n\n\tloginURL := fmt.Sprintf(\"%s/login?cli_callback=%s&cli_state=%s\", appURL, url.QueryEscape(callbackURL), url.QueryEscape(state))\n\n\t// Channel to receive the JWT from the browser callback.\n\tjwtCh := make(chan string, 1)\n\terrCh := make(chan error, 1)","sourceCodeStart":233,"sourceCodeEnd":269,"githubUrl":"https://github.com/multica-ai/multica/blob/2c0912b6ec764b373d44eeea1e80f0d9f11ab417/server/cmd/multica/cmd_auth.go#L233-L269","documentation":"Browser login starts a temporary local HTTP server on a random port to receive the OAuth callback; net.Listen(\"tcp4\", bindAddr+\":0\") binds it. If the bind fails (address in use on the resolved bind addr, firewall blocking loopback listeners, no IPv4 stack) the flow cannot start and returns this wrapped error.","triggerScenarios":"A firewall (corporate endpoint protection) blocking bind on the resolved callback host; the outbound-IP detection path resolving to an address that cannot be bound; IPv4 disabled/unavailable in the environment (some containers); unusually restrictive sandbox denying socket creation.","commonSituations":"Locked-down corporate laptops; container/agent sandboxes with no network or IPv4-only restrictions; SSH sessions where detectOutboundIP picks an unroutable bind address.","solutions":["Use token login which needs no listener: `multica login --token <PAT>`","Pin the callback host flag to loopback (e.g. --callback-host 127.0.0.1) so binding targets localhost","Temporarily allow the CLI to listen on loopback in endpoint firewall policy","If in a sandbox without networking, perform login on the host and mount/copy the profile config"],"exampleFix":"# before (bind on detected outbound IP fails)\nmultica login\n\n# after\nmultica login --callback-host 127.0.0.1\n# or skip the listener entirely\nmultica login --token mul_ABCdef123...","handlingStrategy":"fallback","validationCode":"# cheap pre-check that loopback IPv4 binding works\npython3 - <<'EOF' || echo 'loopback bind blocked — use token login'\nimport socket\ns=socket.socket(socket.AF_INET); s.bind(('127.0.0.1',0)); s.close()\nEOF","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pin --callback-host to 127.0.0.1 in restricted environments","Keep token login as the scripted fallback when the listener cannot bind"],"tags":["cli","auth","network","firewall","login"],"backgroundTag":null,"analyzedSha":"2c0912b6ec764b373d44eeea1e80f0d9f11ab417","analyzedAt":"2026-08-15T13:25:18.241Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}