{"record":{"id":"8f1bb99b1c7397fa","repo":"github/github-mcp-server","slug":"requesting-installation-token-w","errorCode":null,"errorMessage":"requesting installation token: %w","messagePattern":"requesting installation token: %w","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/githubapp/githubapp.go","lineNumber":149,"sourceCode":"\tendpoint, err := url.JoinPath(s.cfg.BaseRESTURL, \"app\", \"installations\", s.cfg.InstallationID, \"access_tokens\")\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"building installation token URL: %w\", err)\n\t}\n\n\tctx, cancel := context.WithTimeout(context.Background(), httpTimeout)\n\tdefer cancel()\n\n\treq, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, nil)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating installation token request: %w\", err)\n\t}\n\treq.Header.Set(\"Authorization\", \"Bearer \"+jwt)\n\treq.Header.Set(\"Accept\", \"application/vnd.github+json\")\n\treq.Header.Set(\"X-GitHub-Api-Version\", \"2022-11-28\")\n\n\tresp, err := s.httpClient.Do(req)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"requesting installation token: %w\", err)\n\t}\n\tdefer func() { _ = resp.Body.Close() }()\n\n\tif resp.StatusCode != http.StatusCreated {\n\t\tsnippet, readErr := io.ReadAll(io.LimitReader(resp.Body, 512))\n\t\tif readErr != nil {\n\t\t\treturn nil, fmt.Errorf(\"installation token request failed: %s (reading response: %w)\", resp.Status, readErr)\n\t\t}\n\t\treturn nil, fmt.Errorf(\"installation token request failed: %s: %s\", resp.Status, strings.TrimSpace(string(snippet)))\n\t}\n\n\tvar body struct {\n\t\tToken     string    `json:\"token\"`\n\t\tExpiresAt time.Time `json:\"expires_at\"`\n\t}\n\tif err := json.NewDecoder(resp.Body).Decode(&body); err != nil {\n\t\treturn nil, fmt.Errorf(\"decoding installation token response: %w\", err)\n\t}","sourceCodeStart":131,"sourceCodeEnd":167,"githubUrl":"https://github.com/github/github-mcp-server/blob/0ea1f775a7c73eff1bd2e25904d01136756bbfe2/internal/githubapp/githubapp.go#L131-L167","documentation":"The POST to the access_tokens endpoint failed at the transport level: DNS resolution, TCP connect, TLS handshake, proxy refusal, or the 30-second httpTimeout elapsing (set at internal/githubapp/githubapp.go:31,136). The %w wrap preserves the *url.Error, whose Timeout()/Temporary() methods classify the failure. No HTTP status was received — the response-handling errors (105/106) are separate.","triggerScenarios":"s.httpClient.Do(req) at internal/githubapp/githubapp.go:147 errors: api.github.com unreachable behind a firewall, corporate proxy env vars (HTTPS_PROXY) pointing at a dead proxy, GHES host with an untrusted TLS cert, DNS failure in the container, or the whole exchange exceeding 30s on a slow link.","commonSituations":"Container without proxy env vars despite an egress proxy being mandatory; self-signed cert on GitHub Enterprise Server without the CA in the container trust store; transient GitHub API outage; IPv6-only resolution failure; DNS flakiness in Kubernetes pods.","solutions":["Check connectivity from the same environment: curl -v -X POST https://api.github.com/app/installations/ID/access_tokens (expect 401, which proves reachability)","If a proxy is required, set HTTPS_PROXY/HTTP_PROXY (and NO_PROXY) in the process environment so Go's default transport uses it","For GHES with private CA, install the CA bundle (SSL_CERT_FILE or system store) — a TLS error appears in the wrapped message","Retry after a short backoff: Provider caches failures only in logs, and the next AccessToken() call re-attempts, so transient outages self-heal"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// reachability probe before first use (optional, cheap):\n//   curl-equivalent: HEAD https://api.github.com/ with the same proxy env\nfunc apiReachable() bool {\n    c := &http.Client{Timeout: 5 * time.Second}\n    resp, err := c.Head(strings.TrimSuffix(baseRESTURL, \"/\"))\n    return err == nil && resp != nil\n}","typeGuard":null,"tryCatchPattern":"var ue *url.Error\nif errors.As(err, &ue) && ue.Timeout() { /* backoff and retry; Provider re-attempts on next AccessToken() */ }","preventionTips":["Configure HTTPS_PROXY/NO_PROXY correctly for the deployment network","For GHES with private CAs, mount the CA and set SSL_CERT_FILE","Rely on Provider's re-attempt on next AccessToken() call rather than caching the empty token"],"tags":["network","proxy","tls","timeout","github-enterprise"],"backgroundTag":null,"analyzedSha":"0ea1f775a7c73eff1bd2e25904d01136756bbfe2","analyzedAt":"2026-08-15T18:10:19.804Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}