A trusted device is required to access this resource, but this session has not been authorized with Device Trust. Follow the Web UI troubleshooting guide to authorize the session with Device Trust.
\nIf accessing the resource through VNet or a local proxy, make sure the device running Teleport Connect or tsh is registered and enrolled. See the app access troubleshooting guide for help.
\n\n\n`\n\t\tw.Header().Set(\"Content-Type\", \"text/html; charset=utf-8\")\n\t\tw.Header().Set(\"X-Content-Type-Options\", \"nosniff\")\n\t\tw.WriteHeader(code)\n\t\t_, _ = w.Write([]byte(body))\n\t\treturn\n\t}\n\n\thttp.Error(w, `A trusted device is required to access this resource but this device has not been registered as a trusted device; use 'tsh device enroll' to register as a trusted device.\n\nSee `+trustedDeviceRequiredDocsURL+` for help.\n`, code)\n}\n\n// isBrowserUserAgent reports whether ua plausibly comes from a web browser, as\n// opposed to a CLI (tsh, curl) or some SDK client. It relies on the historical\n// quirk that essentially every browser UA begins with \"Mozilla/\" and contains\n// a known engine token. Modern browsers (Chrome, Safari, Edge, Opera, mobile\n// browsers) are all WebKit- or Blink-based and carry \"AppleWebKit\"; the Firefox\n// family carries \"Gecko/\".\nfunc isBrowserUserAgent(ua string) bool {\n\tlower := strings.ToLower(ua)\n\treturn strings.HasPrefix(lower, \"mozilla/\") &&\n\t\t(strings.Contains(lower, \"applewebkit\") || strings.Contains(lower, \"gecko/\"))\n}\n\n// getConnectionInfo extracts identity information from the provided","sourceCodeStart":915,"sourceCodeEnd":951,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/srv/app/connections_handler.go#L915-L951","documentation":"Error \"A trusted device is required to access this resource but this device has not been registered as a trusted device; use 'tsh device enroll' to register as a trusted device.\n\nSee https://goteleport.com/docs/zero-trust-access/device-trust/device-management/#troubleshooting for help.\n\" thrown in gravitational/teleport.","triggerScenarios":"Thrown at lib/srv/app/connections_handler.go:933 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Enroll the device: run 'tsh device enroll' with an enrollment token from an administrator","If accessing via VNet or a local proxy, ensure it is launched from the enrolled device and the device certificate is present","See the Device Trust troubleshooting docs linked in the error message"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}