{"record":{"id":"f961efd6b29d94a0","repo":"hashicorp/terraform","slug":"token-is-invalid-s","errorCode":null,"errorMessage":"Token is invalid: %s","messagePattern":"Token is invalid: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/command/login.go","lineNumber":662,"sourceCode":"\t\tdiags := diags.Append(fmt.Errorf(\"Failed to retrieve token: %s\", err))\n\t\treturn \"\", diags\n\t}\n\n\ttoken = strings.TrimSpace(token)\n\tcfg := &tfe.Config{\n\t\tAddress:  service.String(),\n\t\tBasePath: service.Path,\n\t\tToken:    token,\n\t\tHeaders:  make(http.Header),\n\t}\n\tclient, err := tfe.NewClient(cfg)\n\tif err != nil {\n\t\tdiags = diags.Append(fmt.Errorf(\"Failed to create API client: %s\", err))\n\t\treturn \"\", diags\n\t}\n\tuser, err := client.Users.ReadCurrent(context.Background())\n\tif err == tfe.ErrUnauthorized {\n\t\tdiags = diags.Append(fmt.Errorf(\"Token is invalid: %s\", err))\n\t\treturn \"\", diags\n\t} else if err != nil {\n\t\tdiags = diags.Append(fmt.Errorf(\"Failed to retrieve user account details: %s\", err))\n\t\treturn \"\", diags\n\t}\n\tc.Ui.Output(fmt.Sprintf(c.Colorize().Color(\"\\nRetrieved token for user [bold]%s[reset]\\n\"), user.Username))\n\n\treturn svcauth.HostCredentialsToken(token), nil\n}\n\nfunc (c *LoginCommand) interactiveContextConsent(hostname svchost.Hostname, grantType disco.OAuthGrantType, credsCtx *loginCredentialsContext) (bool, tfdiags.Diagnostics) {\n\tvar diags tfdiags.Diagnostics\n\tmechanism := \"OAuth\"\n\tif grantType == \"\" {\n\t\tmechanism = \"your browser\"\n\t}\n\n\tc.Ui.Output(fmt.Sprintf(\"Terraform will request an API token for %s using %s.\\n\", hostname.ForDisplay(), mechanism))","sourceCodeStart":644,"sourceCodeEnd":680,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/command/login.go#L644-L680","documentation":"Thrown by the browser token login flow when the TFE API call client.Users.ReadCurrent returns tfe.ErrUnauthorized. This means the pasted token was syntactically accepted by the client but rejected by the API as not valid (revoked, wrong scope, expired, or typo'd).","triggerScenarios":"Produced during `terraform login` after a token is pasted, when client.Users.ReadCurrent returns exactly tfe.ErrUnauthorized. Triggered by an invalid/expired/revoked token or a token from a different user/account than expected.","commonSituations":"User pasted an expired or already-revoked token, copied the token incompletely, used a token from a different TFC organization/TFC vs TFE mismatch, or the token lacks permission to read the current user.","solutions":["Generate a fresh token in the browser (Tokens page) and re-run `terraform login` to paste it.","Copy the token completely — verify no leading/trailing whitespace or truncation.","Ensure the token is for the correct hostname/account (TFC vs your TFE instance).","If the token is correct, check it was not revoked in the Tokens page."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Optionally sanity-check the token format before the API call (host-specific).\nif strings.TrimSpace(token) == \"\" {\n    return errors.New(\"token is empty; generate one in the browser first\")\n}","typeGuard":null,"tryCatchPattern":"if _, err := client.Users.ReadCurrent(ctx); err != nil {\n    if errors.Is(err, tfe.ErrUnauthorized) {\n        // Token invalid/expired — prompt the user to regenerate and re-run login.\n    }\n    return err\n}","preventionTips":["Generate a fresh token immediately before pasting it.","Copy the token in full without surrounding whitespace.","Confirm the token is for the correct hostname (TFC vs TFE)."],"tags":["terraform","login","token","unauthorized","authentication"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}