{"record":{"id":"f0a145916a1f3d51","repo":"netbirdio/netbird","slug":"create-auth-client-w","errorCode":null,"errorMessage":"create auth client: %w","messagePattern":"create auth client: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/embed/embed.go","lineNumber":260,"sourceCode":"\tc.mu.Lock()\n\tdefer c.mu.Unlock()\n\tif c.connect != nil {\n\t\treturn ErrClientAlreadyStarted\n\t}\n\n\tctx, cancel := context.WithCancel(internal.CtxInitState(context.Background()))\n\tdefer func() {\n\t\tif c.connect == nil {\n\t\t\tcancel()\n\t\t}\n\t}()\n\n\t// nolint:staticcheck\n\tctx = context.WithValue(ctx, system.DeviceNameCtxKey, c.deviceName)\n\n\tauthClient, err := auth.NewAuth(ctx, c.config.PrivateKey, c.config.ManagementURL, c.config)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create auth client: %w\", err)\n\t}\n\tdefer authClient.Close()\n\n\tif err, _ := authClient.Login(ctx, c.setupKey, c.jwtToken); err != nil {\n\t\treturn fmt.Errorf(\"login: %w\", err)\n\t}\n\tclient := internal.NewConnectClient(ctx, c.config, c.recorder)\n\tclient.SetSyncResponsePersistence(true)\n\n\t// either startup error (permanent backoff err) or nil err (successful engine up)\n\t// TODO: make after-startup backoff err available\n\trun := make(chan struct{})\n\tclientErr := make(chan error, 1)\n\tgo func() {\n\t\tif err := client.Run(run, \"\"); err != nil {\n\t\t\tclientErr <- err\n\t\t}\n\t}()","sourceCodeStart":242,"sourceCodeEnd":278,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/embed/embed.go#L242-L278","documentation":"Returned by Client.Start when auth.NewAuth fails to build the management gRPC client. This covers loading/deriving the peer's private key material, parsing the management URL into a gRPC target, and preparing the TLS connection to the management server. The client never attempts a login when this error is returned.","triggerScenarios":"Client.Start with a config whose ManagementURL is empty or malformed (bad scheme/host), a PrivateKey that cannot be parsed as a WireGuard key, or an environment where the TLS credentials/PKI setup fails.","commonSituations":"Typical after fixing auth: the management URL lacks the scheme (api.example.com instead of https://api.example.com), a hand-edited config file holds a truncated or base64-corrupted private key, or an updated management server changed its certificate setup so client credential preparation fails.","solutions":["Inspect the wrapped error: parse failures point to PrivateKey/ManagementURL, TLS errors at the PKI setup.","Print/verify config via Client.GetConfig (ManagementURL, key presence) before Start.","Regenerate the private key or re-register the peer if the key material is suspect.","Ensure the management URL includes scheme and port and is reachable from the host."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"cfg, err := client.GetConfig()\nif err == nil {\n    if u, uerr := url.Parse(cfg.ManagementURL.String()); uerr != nil || u.Scheme == \"\" || u.Host == \"\" {\n        return fmt.Errorf(\"management URL invalid: %s\", cfg.ManagementURL)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := client.Start(ctx); err != nil {\n    if strings.Contains(err.Error(), \"create auth client\") {\n        // config/PKI problem: fix config, recreate client; retrying Start will not help\n    }\n}","preventionTips":["Always include scheme in ManagementURL (https://...).","Do not hand-edit stored private keys; regenerate and re-register instead."],"tags":["auth","network","tls","embed"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}