{"record":{"id":"f5d8fee9ce19385e","repo":"hashicorp/terraform","slug":"the-credentials-q-block-has-an-invalid-hostname","errorCode":null,"errorMessage":"The credentials %q block has an invalid hostname: %s","messagePattern":"The credentials %q block has an invalid hostname: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/command/cliconfig/cliconfig.go","lineNumber":308,"sourceCode":"\t// to give proper source references to any errors. We should improve\n\t// on this when we change the CLI config parser to use HCL2.\n\n\t// Check that all \"host\" blocks have valid hostnames.\n\tfor givenHost := range c.Hosts {\n\t\t_, err := svchost.ForComparison(givenHost)\n\t\tif err != nil {\n\t\t\tdiags = diags.Append(\n\t\t\t\tfmt.Errorf(\"The host %q block has an invalid hostname: %s\", givenHost, err),\n\t\t\t)\n\t\t}\n\t}\n\n\t// Check that all \"credentials\" blocks have valid hostnames.\n\tfor givenHost := range c.Credentials {\n\t\t_, err := svchost.ForComparison(givenHost)\n\t\tif err != nil {\n\t\t\tdiags = diags.Append(\n\t\t\t\tfmt.Errorf(\"The credentials %q block has an invalid hostname: %s\", givenHost, err),\n\t\t\t)\n\t\t}\n\t}\n\n\t// Should have zero or one \"credentials_helper\" blocks\n\tif len(c.CredentialsHelpers) > 1 {\n\t\tdiags = diags.Append(\n\t\t\tfmt.Errorf(\"No more than one credentials_helper block may be specified\"),\n\t\t)\n\t}\n\n\t// Should have zero or one \"provider_installation\" blocks\n\tif len(c.ProviderInstallation) > 1 {\n\t\tdiags = diags.Append(\n\t\t\tfmt.Errorf(\"No more than one provider_installation block may be specified\"),\n\t\t)\n\t}\n","sourceCodeStart":290,"sourceCodeEnd":326,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/command/cliconfig/cliconfig.go#L290-L326","documentation":"Emitted by `Config.Validate` (cliconfig.go:304-310) when a `credentials` block's label fails `svchost.ForComparison`. Same hostname rules as error 549 but applied to the `credentials \"<host>\" { token = ... }` block. The `%s` values are the host label and the svchost error.","triggerScenarios":"A `credentials \"...\" { }` block whose label is not a valid service hostname (underscores, scheme prefix, spaces, empty/oversized labels).","commonSituations":"`credentials \"_vault\" { ... }`; pasting a full URL as the host; mis-typed hostname with a space; an IDN that fails conversion.","solutions":["Set the label to the bare registry host, e.g. `credentials \"app.terraform.io\" { token = \"...\" }`.","Strip scheme/path/port from the label.","For tokens keyed by host, prefer the `TF_TOKEN_<host>` environment variable if the label is awkward (dots→underscores).","Validate the hostname normalizes under svchost before saving."],"exampleFix":"# before\ncredentials \"https://app.terraform.io\" {\n  token = \"atlasv1...\"\n}\n# The credentials \"https://app.terraform.io\" block has an invalid hostname: ...\n\n# after\ncredentials \"app.terraform.io\" {\n  token = \"atlasv1...\"\n}","handlingStrategy":"validation","validationCode":"// Reuse the svchost validator for credentials block labels.\nimport svchost \"github.com/hashicorp/terraform-svchost\"\n\nfunc credentialsHostOK(label string) error {\n    if _, err := svchost.ForComparison(label); err != nil {\n        return fmt.Errorf(\"invalid credentials host %q: %w\", label, err)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Label `credentials` blocks with the bare registry hostname.","For tricky hostnames, use `TF_TOKEN_<host>` instead (dots→underscores).","Strip scheme/path/port from labels."],"tags":["terraform","cli-config","credentials","hostname","validation"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}