{"record":{"id":"bd054f6c4e6f22d0","repo":"docker/cli","slug":"credentials-erased-successfully-but-there-was-a-f","errorCode":null,"errorMessage":"credentials erased successfully, but there was a failure to revoke the OAuth refresh token with the tenant: %w","messagePattern":"credentials erased successfully, but there was a failure to revoke the OAuth refresh token with the tenant: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"internal/oauth/manager/manager.go","lineNumber":184,"sourceCode":"\tif err != nil {\n\t\treturn err\n\t}\n\tif refreshConfig.Password == \"\" {\n\t\treturn nil\n\t}\n\tparts := strings.Split(refreshConfig.Password, \"..\")\n\tif len(parts) != 2 {\n\t\t// the token wasn't stored by the CLI, so don't revoke it\n\t\t// or erase it from the store/error\n\t\treturn nil\n\t}\n\t// erase the token from the store first, that way\n\t// if the revoke fails, the user can try to logout again\n\tif err := m.eraseTokensFromStore(); err != nil {\n\t\treturn fmt.Errorf(\"failed to erase tokens: %w\", err)\n\t}\n\tif err := m.api.RevokeToken(ctx, parts[0]); err != nil {\n\t\treturn fmt.Errorf(\"credentials erased successfully, but there was a failure to revoke the OAuth refresh token with the tenant: %w\", err)\n\t}\n\treturn nil\n}\n\nconst (\n\taccessTokenKey  = registry.IndexServer + \"access-token\"\n\trefreshTokenKey = registry.IndexServer + \"refresh-token\"\n)\n\nfunc (m *OAuthManager) storeTokensInStore(tokens api.TokenResponse, username string) error {\n\treturn errors.Join(\n\t\tm.store.Store(types.AuthConfig{\n\t\t\tUsername:      username,\n\t\t\tPassword:      tokens.AccessToken,\n\t\t\tServerAddress: accessTokenKey,\n\t\t}),\n\t\tm.store.Store(types.AuthConfig{\n\t\t\tUsername:      username,","sourceCodeStart":166,"sourceCodeEnd":202,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/internal/oauth/manager/manager.go#L166-L202","documentation":"Returned by OAuthManager.Logout after eraseTokensFromStore succeeded but RevokeToken (POST <TenantURL>/oauth/revoke) failed. Locally stored tokens are gone, but the tenant still considers the refresh token valid. The error is wrapped with %w so callers can see the revoke failure reason.","triggerScenarios":"Logout reaches the revoke step with a network/TLS/HTTP failure (non-200 from /oauth/revoke, or transport error). Because erase already happened, a retry needs a stored token that no longer exists.","commonSituations":"Transient network blip or tenant outage at the exact revoke call; corporate proxy blocking /oauth/revoke; the refresh token already expired at the tenant so revoke 400s.","solutions":["Accept the warning if local erasure is sufficient for your threat model (token will expire at tenant naturally).","If you must revoke, manually revoke via the Hub UI (revoke the token/session).","Check network/proxy to /oauth/revoke and retry logout only if a token is still stored."],"exampleFix":"# before\ndocker logout\n# -> credentials erased successfully, but revoke failed\n# after: token is gone locally; revoke from Hub UI\n# hub.docker.com -> Account Settings -> Security -> revoke the session\n# (or ignore; the refresh token will expire per tenant policy)","handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"// erase succeeded; revoke failed -> treat as soft warning\nif strings.Contains(err.Error(), \"credentials erased successfully\") { log.Warn(err); return nil }","preventionTips":["Treat local erasure as the primary logout guarantee.","Provide a UI path to revoke outstanding tokens.","Document that the refresh token expires at the tenant on its own."],"tags":["oauth","docker-hub","logout","revoke","auth","network"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}