{"record":{"id":"971788ade005987d","repo":"warpdotdev/warp","slug":"timed-out-establishing-iap-access-to-warp-server","errorCode":null,"errorMessage":"Timed out establishing IAP access to warp-server.","messagePattern":"Timed out establishing IAP access to warp-server\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"app/src/ai/agent_sdk/mod.rs","lineNumber":1663,"sourceCode":"            return;\n        }\n        match event {\n            IapManagerEvent::StateChanged\n                if IapManager::handle(ctx).as_ref(ctx).has_valid_token() =>\n            {\n                handled = true;\n                authenticate_and_dispatch(\n                    ctx,\n                    command.clone(),\n                    global_options.clone(),\n                    authentication.clone(),\n                    parent_span.clone(),\n                );\n            }\n            IapManagerEvent::AccessUnavailable => {\n                handled = true;\n                report_fatal_error(\n                    anyhow::anyhow!(\"Timed out establishing IAP access to warp-server.\"),\n                    ctx,\n                );\n            }\n            _ => {}\n        }\n    });\n\n    iap.update(ctx, |manager, ctx| manager.ensure_access(ctx));\n\n    Ok(())\n}\n\n/// Subscribes to auth events, authenticates, and dispatches the command once\n/// auth completes. Assumes IAP access (if applicable) is already established.\nfn authenticate_and_dispatch(\n    ctx: &mut AppContext,\n    command: CliCommand,\n    global_options: GlobalOptions,","sourceCodeStart":1645,"sourceCodeEnd":1681,"githubUrl":"https://github.com/warpdotdev/warp/blob/e72fd7aacbbb2236d9b3be2aad7e7178fe94b4bc/app/src/ai/agent_sdk/mod.rs#L1645-L1681","documentation":"On staging, warp-server is fronted by Identity-Aware Proxy; before dispatching any authed command the CLI calls IapManager.ensure_access to establish an IAP token. If the manager emits AccessUnavailable — the token could not be obtained within its window — the command aborts with this fatal error. It is an environment/access problem, not a credentials-format problem.","triggerScenarios":"Any auth-required command against a staging server_url with IAP enabled, where IAP token acquisition fails: network to the IAP endpoint blocked, SSO context rejected or absent, or the IAP handshake timing out.","commonSituations":"Corporate proxy/firewall blocking the IAP domain; VPN split-tunneling dropping the staging endpoint; staging-side outages; accidentally targeting the staging SERVER_ROOT_URL from a production workflow.","solutions":["Check network/proxy/VPN access to the staging IAP endpoint and retry","Re-run `warp login` so fresh SSO credentials are available for the IAP flow","Verify SERVER_ROOT_URL points at the environment you actually intend (staging vs production mix-ups are common)","If it persists, check staging server health before retrying"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"# Connectivity preflight to the staging front door before long commands\ncurl -fsS --max-time 10 \"$SERVER_ROOT_URL\" >/dev/null || { echo 'staging endpoint unreachable; check VPN/proxy' >&2; exit 1; }","typeGuard":null,"tryCatchPattern":"for i in 1 2 3; do\n  out=$(warp agent list 2>&1) && { echo \"$out\"; exit 0; }\n  case \"$out\" in *'Timed out establishing IAP access'*) wait $((i * 10));; *) echo \"$out\" >&2; exit 1;; esac\ndone\necho 'IAP access repeatedly unavailable' >&2; exit 1","preventionTips":["Verify VPN/proxy reachability of the IAP endpoint before staging runs","Keep SSO sessions fresh; re-login before long batch jobs","Double-check SERVER_ROOT_URL so production workflows never hit staging IAP"],"tags":["authentication","iap","network","staging","timeout"],"backgroundTag":null,"analyzedSha":"e72fd7aacbbb2236d9b3be2aad7e7178fe94b4bc","analyzedAt":"2026-08-16T08:27:25.381Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}