What causes "failed to fetch OIDC auth: %w" in dagger/dagger?

Inspect the wrapped cause: 'failed to get OIDC token' points to the OIDC exchange, 'failed to set current org' points to a local write problem.

dagger/dagger · error

failed to fetch OIDC auth: %w

Error message

failed to fetch OIDC auth: %w

What it means

When GetDaggerCloudAuth is called with the special token value "oidc", it delegates to fetchOIDCAuth to obtain a short-lived OIDC bearer token. This error wraps any failure from that fetch, including the underlying 'failed to get OIDC token' and 'failed to set current org' errors. It means OIDC-based authentication with Dagger Cloud could not be completed.

Source

Thrown at internal/cloud/auth/auth.go:326

	if oidcErr != nil {
		return "", fmt.Errorf("failed to get OIDC token: %w", oidcErr)
	}

	if err := SetCurrentOrg(&Org{ID: oidcLogin.OrgID, Name: oidcLogin.OrgName}); err != nil {
		return "", fmt.Errorf("failed to set current org from OIDC token: %w", err)
	}

	return oidcLogin.Token, nil
}

func GetDaggerCloudAuth(ctx context.Context, token string) (string, error) {
	if token == "" {
		return "", fmt.Errorf("DAGGER_CLOUD_TOKEN environment variable is not set")
	}
	if token == "oidc" {
		oidc, err := fetchOIDCAuth(ctx)
		if err != nil {
			return "", fmt.Errorf("failed to fetch OIDC auth: %w", err)
		}
		return "Bearer " + oidc, nil
	}

	return "Basic " + base64.StdEncoding.EncodeToString([]byte(token+":")), nil
}

type oidcTokenResponse struct {
	Token   string `json:"token"`
	OrgID   string `json:"org_id"`
	OrgName string `json:"org_name"`
}

func getOIDCToken(ctx context.Context) (*oidcTokenResponse, error) {
	// support for GitHub's OIDC environment variables
	ghToken := os.Getenv("ACTIONS_ID_TOKEN_REQUEST_TOKEN")
	ghURL := os.Getenv("ACTIONS_ID_TOKEN_REQUEST_URL")
	if ghToken != "" && ghURL != "" {

View on GitHub (pinned to 82ba2681db)

Solutions

Inspect the wrapped cause: 'failed to get OIDC token' points to the OIDC exchange, 'failed to set current org' points to a local write problem.
In GitHub Actions, grant the job 'permissions: id-token: write' so the OIDC request token/URL are available.
If not running where OIDC is available, replace the value 'oidc' with a real Dagger Cloud API token in DAGGER_CLOUD_TOKEN.
If the cause is the org-file write, ensure the config directory is writable (mount a writable volume / fix HOME).

Example fix

# before
env:
  DAGGER_CLOUD_TOKEN: oidc  # fails locally: no OIDC provider
# after (local run)
env:
  DAGGER_CLOUD_TOKEN: <your-api-token>

Defensive patterns

Strategy: fallback

Validate before calling

useOIDC := os.Getenv("DAGGER_CLOUD_TOKEN") == "oidc" &&
    os.Getenv("ACTIONS_ID_TOKEN_REQUEST_TOKEN") != "" &&
    os.Getenv("ACTIONS_ID_TOKEN_REQUEST_URL") != ""
if !useOIDC {
    // choose a static token path instead
}

Try / catch

auth, err := auth.GetDaggerCloudAuth(ctx, "oidc")
if err != nil && strings.Contains(err.Error(), "failed to fetch OIDC auth") {
    if static := os.Getenv("DAGGER_CLOUD_TOKEN"); static != "" && static != "oidc" {
        auth, err = auth.GetDaggerCloudAuth(ctx, static)
    }
}

Prevention

Only use token="oidc" in environments that provide GitHub OIDC variables.
Set 'permissions: id-token: write' on the GitHub Actions job.
Maintain a static API token fallback for local and non-GitHub CI environments.
Resolve the wrapped cause ('failed to get OIDC token' vs 'failed to set current org') before changing configuration.

When it happens

Trigger: Calling GetDaggerCloudAuth(ctx, "oidc") when fetchOIDCAuth fails: OIDC env vars missing in CI (getOIDCToken error) or the local org file cannot be written after a successful exchange (SetCurrentOrg error).

Common situations: Setting DAGGER_CLOUD_TOKEN=oidc outside an environment that provides GitHub OIDC variables (local shell, non-GitHub CI); GitHub Actions job missing id-token: write permission; read-only filesystem blocking the org-file write.

Related errors

AI-assisted analysis of dagger/dagger@82ba2681db (2026-09-05). Data as JSON: /api/errors/15da5396483b31ad. Report an issue: GitHub.