{"record":{"id":"9365ca14b20158a6","repo":"windmill-labs/windmill","slug":"unauthorized-access-to-private-hub-hubbaseurl","errorCode":null,"errorMessage":"Unauthorized access to private hub: ${hubBaseUrl}","messagePattern":"Unauthorized access to private hub: (.+?)","errorType":"exception","errorClass":null,"httpStatus":401,"severity":"error","filePath":"cli/src/commands/hub/hub.ts","lineNumber":73,"sourceCode":"    log.info(\"Fetching resource types from private hub: \" + hubBaseUrl);\n    if (hubSecret) {\n      log.info(\"Using hub API secret\");\n      headers[\"X-api-secret\"] = hubSecret;\n    }\n  }\n\n  if (uid) {\n    headers[\"X-uid\"] = uid;\n  }\n\n  let res1 = await fetch(hubBaseUrl + \"/resource_types/list\", {\n    headers,\n  });\n\n  if (!res1.ok) {\n    if (res1.status === 401) {\n      // 401 can only happen on a private hub\n      throw new Error(\"Unauthorized access to private hub: \" + hubBaseUrl);\n    } else {\n      throw new Error(\n        \"Couldn't fetch resource types from hub \" +\n          hubBaseUrl +\n          \": \" +\n          (await res1.text())\n      );\n    }\n  }\n\n  let list = (await res1.json()) as HubResourceType[];\n\n  if (list && list.length === 0 && hubBaseUrl !== DEFAULT_HUB_BASE_URL) {\n    log.info(\n      \"No resource types found in private hub, fetching from public hub\"\n    );\n    delete headers[\"X-api-secret\"];\n    const res2 = await fetch(DEFAULT_HUB_BASE_URL + \"/resource_types/list\", {","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/cli/src/commands/hub/hub.ts#L55-L91","documentation":"Auth guard when pulling resource types from a hub: the POST to {hubBaseUrl}/resource_types/list returned HTTP 401. The code treats 401 as unambiguous — this only happens on private hubs — so the request reached the hub but its authentication rejected the request: missing/invalid API secret (X-api-secret header) for a private hub, or an expired/incorrect credential. The input at fault is the hub secret / credentials configured for that hub base URL.","triggerScenarios":"Thrown at cli/src/commands/hub/hub.ts:73 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the hub API secret passed via hubSecret (X-api-secret header) is current for that private hub","Confirm the hub base URL targets the right hub instance and the token belongs to an account with access","If the secret rotated, obtain a new one from the hub operator and re-run with the updated credential"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}