{"record":{"id":"9c2112e0334f54b0","repo":"hashicorp/terraform","slug":"failed-to-retrieve-token-s","errorCode":null,"errorMessage":"Failed to retrieve token: %s","messagePattern":"Failed to retrieve token: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/command/login.go","lineNumber":644,"sourceCode":"\n\t// credsCtx might not be set if we're using a mock credentials source\n\t// in a test, but it should always be set in normal use.\n\tif credsCtx != nil {\n\t\tswitch credsCtx.Location {\n\t\tcase cliconfig.CredentialsViaHelper:\n\t\t\tc.Ui.Output(fmt.Sprintf(\"Terraform will store the token in the configured %q credentials helper\\nfor use by subsequent commands.\\n\", credsCtx.HelperType))\n\t\tcase cliconfig.CredentialsInPrimaryFile, cliconfig.CredentialsNotAvailable:\n\t\t\tc.Ui.Output(fmt.Sprintf(\"Terraform will store the token in plain text in the following file\\nfor use by subsequent commands:\\n    %s\\n\", credsCtx.LocalFilename))\n\t\t}\n\t}\n\n\ttoken, err := c.UIInput().Input(context.Background(), &terraform.InputOpts{\n\t\tId:     \"token\",\n\t\tQuery:  fmt.Sprintf(\"Token for %s:\", hostname.ForDisplay()),\n\t\tSecret: true,\n\t})\n\tif err != nil {\n\t\tdiags := diags.Append(fmt.Errorf(\"Failed to retrieve token: %s\", err))\n\t\treturn \"\", diags\n\t}\n\n\ttoken = strings.TrimSpace(token)\n\tcfg := &tfe.Config{\n\t\tAddress:  service.String(),\n\t\tBasePath: service.Path,\n\t\tToken:    token,\n\t\tHeaders:  make(http.Header),\n\t}\n\tclient, err := tfe.NewClient(cfg)\n\tif err != nil {\n\t\tdiags = diags.Append(fmt.Errorf(\"Failed to create API client: %s\", err))\n\t\treturn \"\", diags\n\t}\n\tuser, err := client.Users.ReadCurrent(context.Background())\n\tif err == tfe.ErrUnauthorized {\n\t\tdiags = diags.Append(fmt.Errorf(\"Token is invalid: %s\", err))","sourceCodeStart":626,"sourceCodeEnd":662,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/command/login.go#L626-L662","documentation":"Thrown by the browser/UI-based login flow when the UI input call asking the user to paste a generated token fails. The %s carries the input error. Unlike 633/634 this is the token-paste flow (interactiveGetTokenByUI), where the user generates a token in the browser and pastes it at the prompt.","triggerScenarios":"Produced when c.UIInput().Input() returns a non-nil error for the 'token' (Secret) prompt during `terraform login` on a host using the UI token flow (no password grant, browser launched). Triggered when interactive input is unavailable after the browser step.","commonSituations":"Non-interactive environment (CI, no TTY, -input=false) attempting the browser token flow; stdin closed; or a custom UI input that errors. The user reached the paste-token prompt but the input read failed.","solutions":["Run `terraform login` in an interactive terminal so the token paste prompt can be answered.","Avoid -input=false with `terraform login`.","If non-interactive, skip the command and write the token to ~/.terraform.d/credentials.tfrc.json manually.","Use a credentials helper or TF_TOKEN_<hostname> env var for automation."],"exampleFix":"// manual credentials file (~/.terraform.d/credentials.tfrc.json)\n{\n  \"credentials\": {\n    \"app.terraform.io\": { \"token\": \"<your-token>\" }\n  }\n}","handlingStrategy":"validation","validationCode":"// Before the token-paste flow, confirm interactive input is possible.\nif !ui.InputEnabled() || !term.IsTerminal(int(os.Stdin.Fd())) {\n    return errors.New(\"token paste requires an interactive terminal; write credentials.tfrc.json manually\")\n}","typeGuard":null,"tryCatchPattern":"if _, err := cmd.TokenPrompt(); err != nil {\n    // Prompt failed — write the token to the credentials file directly instead.\n    return err\n}","preventionTips":["Use an interactive terminal for the token-paste flow.","For automation, generate the token in the browser then place it in the credentials file or TF_TOKEN_<hostname>.","Do not combine `terraform login` with -input=false or piped stdin."],"tags":["terraform","login","interactive","token","input"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}