{"record":{"id":"ce522d20b050acc2","repo":"docker/cli","slug":"unexpected-response-from-hub-s","errorCode":null,"errorMessage":"unexpected response from Hub: %s","messagePattern":"unexpected response from Hub: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/oauth/api/api.go","lineNumber":245,"sourceCode":"func (API) GetAutoPAT(ctx context.Context, audience string, res TokenResponse) (string, error) {\n\tpatURL := audience + \"/v2/access-tokens/desktop-generate\"\n\treq, err := http.NewRequestWithContext(ctx, http.MethodPost, patURL, nil)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\treq.Header.Set(\"Authorization\", \"Bearer \"+res.AccessToken)\n\treq.Header.Set(\"Content-Type\", \"application/json\")\n\tresp, err := http.DefaultClient.Do(req)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tdefer func() {\n\t\t_ = resp.Body.Close()\n\t}()\n\n\tif resp.StatusCode != http.StatusCreated {\n\t\treturn \"\", fmt.Errorf(\"unexpected response from Hub: %s\", resp.Status)\n\t}\n\n\tvar response patGenerateResponse\n\terr = json.NewDecoder(resp.Body).Decode(&response)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\treturn response.Data.Token, nil\n}\n\ntype patGenerateResponse struct {\n\tData struct {\n\t\tToken string `json:\"token\"`\n\t}\n}\n","sourceCodeStart":227,"sourceCodeEnd":262,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/internal/oauth/api/api.go#L227-L262","documentation":"Returned by GetAutoPAT() when POST <audience>/v2/access-tokens/desktop-generate does not return HTTP 201 Created. The response status string is included. This step exchanges the OAuth access token for a Hub auto-generated Personal Access Token after successful device-flow login.","triggerScenarios":"Device-flow login succeeded and an access token was issued, but the Hub endpoint that mints the desktop PAT returned an unexpected status (401, 403, 404, 5xx, etc.).","commonSituations":"Hub account lacks permission / not provisioned for desktop PAT; audience URL misconfigured; Hub service degradation; access token expired between steps; Hub API version change.","solutions":["Retry `docker login` — a transient Hub 5xx usually clears.","Check the Hub account is in good standing and can create access tokens in the UI.","Update the CLI (audience/endpoint may have moved).","Fall back to a manually created PAT (docker login -u <user> with the PAT as password)."],"exampleFix":"# before (desktop PAT generation fails)\ndocker login\n# after: use a manual PAT created at hub.docker.com/settings/security\ndocker login -u myuser\n# Password: <paste PAT>","handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"if strings.Contains(err.Error(), \"unexpected response from Hub\") {\n    // fall back to a manual PAT login instead of device-flow auto PAT\n}","preventionTips":["Have a manual PAT ready as a fallback for CI.","Confirm the Hub account can create access tokens.","Retry on transient 5xx before falling back."],"tags":["oauth","docker-hub","pat","auth","device-flow"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}