{"record":{"id":"932be86e13210159","repo":"netbirdio/netbird","slug":"getting-pkce-authorization-flow-info-failed-with-e","errorCode":null,"errorMessage":"getting pkce authorization flow info failed with error: %v","messagePattern":"getting pkce authorization flow info failed with error: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"client/internal/auth/oauth.go","lineNumber":97,"sourceCode":"\tif err != nil {\n\t\tlog.Debugf(\"failed to initialize pkce authentication with error: %v\\n\", err)\n\t\tlog.Debug(\"falling back to device code flow\")\n\t\treturn authenticateWithDeviceCodeFlow(ctx, config, hint)\n\t}\n\treturn pkceFlow, nil\n}\n\n// authenticateWithPKCEFlow initializes the Proof Key for Code Exchange flow auth flow\nfunc authenticateWithPKCEFlow(ctx context.Context, config *profilemanager.Config, hint string) (OAuthFlow, error) {\n\tauthClient, err := NewAuth(ctx, config.PrivateKey, config.ManagementURL, config)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create auth client: %v\", err)\n\t}\n\tdefer authClient.Close()\n\n\tpkceFlowInfo, err := authClient.getPKCEFlow(authClient.client)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"getting pkce authorization flow info failed with error: %v\", err)\n\t}\n\n\tif hint != \"\" {\n\t\tpkceFlowInfo.SetLoginHint(hint)\n\t}\n\n\treturn pkceFlowInfo, nil\n}\n\n// authenticateWithDeviceCodeFlow initializes the Device Code auth Flow\nfunc authenticateWithDeviceCodeFlow(ctx context.Context, config *profilemanager.Config, hint string) (OAuthFlow, error) {\n\tauthClient, err := NewAuth(ctx, config.PrivateKey, config.ManagementURL, config)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create auth client: %v\", err)\n\t}\n\tdefer authClient.Close()\n\n\tdeviceFlowInfo, err := authClient.getDeviceFlow(authClient.client)","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/internal/auth/oauth.go#L79-L115","documentation":"Returned by authenticateWithPKCEFlow when the getPKCEFlow management RPC fails after a successful connection (client/internal/auth/oauth.go:95-98). The RPC asks management for the PKCE/SSO provider configuration; errors include Unimplemented from older management servers that predate this endpoint, NotFound when no IdP is configured, or any transport/permission error. Unlike the device flow, this path has no gRPC code switch, so raw status text surfaces. NewOAuthFlow logs this at debug and falls back to the device code flow, so users see it mainly in debug logs; the surfaced error comes from the fallback (927-930).","triggerScenarios":"authClient.getPKCEFlow(authClient.client) returns an error: management version predating the login PKCE-provider RPC (codes.Unimplemented), account without a configured IdP (NotFound), expired login session token, or a transient gRPC failure.","commonSituations":"Client newer than a self-hosted management server (PKCE RPC not implemented yet); IdP removed from the account while the user attempts interactive login; management restarted mid-request.","solutions":["Run netbird up --log-level debug to confirm whether the subsequent device-code fallback also failed - the real user-facing error is 927-930","Update self-hosted management to a version matching the client so the PKCE endpoint exists","Ensure an IdP/SSO provider is configured for the account in management","Retry after management is healthy; transient gRPC errors resolve on a new flow"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"// In callers of NewOAuthFlow: PKCE init errors are already handled by fallback to device flow.\nflow, err := auth.NewOAuthFlow(ctx, cfg, isDesktop, forceDeviceFlow, hint)\nif err != nil {\n\tif gstatus, ok := gstatus.FromError(errors.Unwrap(err)); ok && gstatus.Code() == codes.Unimplemented {\n\t\t// management too old for provider-config RPCs\n\t}\n}","preventionTips":["Keep management and client versions roughly in sync so provider-config RPCs exist","Configure an IdP for the account before offering interactive SSO login","Use debug logging to distinguish a swallowed PKCE failure from a terminal device-flow failure"],"tags":["grpc","pkce","management","sso","version-mismatch"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}