{"record":{"id":"9535be17743de2f4","repo":"tailscale/tailscale","slug":"could-not-detect-environment-provide-id-token-e","errorCode":null,"errorMessage":"could not detect environment; provide --id-token explicitly","messagePattern":"could not detect environment; provide --id-token explicitly","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"wif/wif.go","lineNumber":56,"sourceCode":"// and then tries to obtain an ID token for the audience that is passed as an argument\n// To detect the environment, we do it in the following intentional order:\n//  1. GitHub Actions (strongest env signals; may run atop any cloud)\n//  2. AWS via IMDSv2 token endpoint (does not require env vars)\n//  3. GCP via metadata header semantics\n//  4. AWS ECS via ECS token endpoint and env vars provided by ECS\n//  5. Azure via metadata endpoint\nfunc ObtainProviderToken(ctx context.Context, audience string) (string, error) {\n\tenv := detectEnvironment(ctx)\n\n\tswitch env {\n\tcase EnvGitHub:\n\t\treturn acquireGitHubActionsIDToken(ctx, audience)\n\tcase EnvAWS:\n\t\treturn acquireAWSWebIdentityToken(ctx, audience)\n\tcase EnvGCP:\n\t\treturn acquireGCPMetadataIDToken(ctx, audience)\n\tdefault:\n\t\treturn \"\", errors.New(\"could not detect environment; provide --id-token explicitly\")\n\t}\n}\n\nfunc detectEnvironment(ctx context.Context) Environment {\n\tif os.Getenv(\"ACTIONS_ID_TOKEN_REQUEST_URL\") != \"\" &&\n\t\tos.Getenv(\"ACTIONS_ID_TOKEN_REQUEST_TOKEN\") != \"\" {\n\t\treturn EnvGitHub\n\t}\n\n\tclient := httpClient()\n\tif detectAWSIMDSv2(ctx, client) {\n\t\treturn EnvAWS\n\t}\n\tif detectGCPMetadata(ctx, client) {\n\t\treturn EnvGCP\n\t}\n\tif os.Getenv(\"ECS_CONTAINER_METADATA_URI_V4\") != \"\" {\n\t\treturn EnvAWS","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/tailscale/tailscale/blob/6e0912f97994f927632b34ae9e63b53d6516a6ac/wif/wif.go#L38-L74","documentation":"Raised by ObtainProviderToken when environment detection matched none of GitHub Actions, AWS IMDS, GCP metadata, ECS, or Azure. Workload identity federation cannot mint an ID token without knowing which provider to ask, so the user must supply the token via the --id-token flag. The condition is an unrecognized runtime environment.","triggerScenarios":"Thrown at wif/wif.go:56 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Pass --id-token explicitly with a token from your identity provider","Run inside a supported environment with metadata endpoints reachable","Check network access to the metadata service"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e0912f97994f927632b34ae9e63b53d6516a6ac","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}