dagger/dagger · error

failed to get OIDC token: %w

Error message

failed to get OIDC token: %w

What it means

fetchOIDCAuth wraps any error from getOIDCToken (the once-per-process OIDC login that calls GitHub's OIDC endpoint and Dagger Cloud's /v1/oidc endpoint) with this message. It means the OIDC token acquisition failed at some point inside getOIDCToken; the wrapped error (%w) tells you which step (request creation, HTTP call, decode, or Dagger Cloud exchange) actually failed. Because the fetch is memoized with sync.Once, a failed result is cached for the process lifetime and every subsequent call returns the same wrapped error.

Source

Thrown at internal/cloud/auth/auth.go:309

	return writeFile(orgFile, data, 0o600)
}

var (
	oidcOnce  sync.Once
	oidcLogin *oidcTokenResponse
	oidcErr   error
)

func fetchOIDCAuth(ctx context.Context) (string, error) {
	// getOIDCToken calls both GitHub OIDC as well as Dagger Cloud's own OIDC endpoint
	// It's not a big deal if we call it more than once per session but

	// it makes sense to avoid it were possible.
	oidcOnce.Do(func() {
		oidcLogin, oidcErr = getOIDCToken(ctx)
	})
	if oidcErr != nil {
		return "", fmt.Errorf("failed to get OIDC token: %w", oidcErr)
	}

	if err := SetCurrentOrg(&Org{ID: oidcLogin.OrgID, Name: oidcLogin.OrgName}); err != nil {
		return "", fmt.Errorf("failed to set current org from OIDC token: %w", err)
	}

	return oidcLogin.Token, nil
}

func GetDaggerCloudAuth(ctx context.Context, token string) (string, error) {
	if token == "" {
		return "", fmt.Errorf("DAGGER_CLOUD_TOKEN environment variable is not set")
	}
	if token == "oidc" {
		oidc, err := fetchOIDCAuth(ctx)
		if err != nil {
			return "", fmt.Errorf("failed to fetch OIDC auth: %w", err)
		}

View on GitHub (pinned to 82ba2681db)

Solutions

1. Inspect the wrapped (%w) cause to identify which inner step failed, since this message itself is just a wrapper.
2. In GitHub Actions, add 'permissions: { id-token: write }' to the workflow/job so ACTIONS_ID_TOKEN_REQUEST_TOKEN and ACTIONS_ID_TOKEN_REQUEST_URL are populated.
3. Verify network access from the runner to the ACTIONS_ID_TOKEN_REQUEST_URL and to Dagger Cloud's API endpoint.
4. If OIDC is not intended, set DAGGER_CLOUD_TOKEN to an actual API token instead of 'oidc' to bypass the OIDC path entirely.
5. Restart the process if a transient failure was cached by sync.Once (the failed result is memoized for the process lifetime).

Example fix

# before (GitHub Actions workflow, OIDC disabled by default)
jobs:
  deploy:
    steps:
      - run: dagger run ...
# after
jobs:
  deploy:
    permissions:
      id-token: write
    steps:
      - run: dagger run ...

if os.Getenv("ACTIONS_ID_TOKEN_REQUEST_TOKEN") == "" || os.Getenv("ACTIONS_ID_TOKEN_REQUEST_URL") == "" {
    // not in a GitHub OIDC-capable environment; don't attempt 'oidc' auth
    return errors.New("OIDC unavailable: ACTIONS_ID_TOKEN_REQUEST_* env vars are not set")
}

auth, err := auth.GetDaggerCloudAuth(ctx, "oidc")
if err != nil && strings.Contains(err.Error(), "failed to get OIDC token") {
    // fall back to a static token or surface the wrapped cause
    return fmt.Errorf("OIDC auth unavailable: %w", err)
}

When it happens

Trigger: Calling GetCloudAuth or GetDaggerCloudAuth with token == "oidc" when getOIDCToken fails: missing/malformed ACTIONS_ID_TOKEN_REQUEST_URL or ACTIONS_ID_TOKEN_REQUEST_TOKEN env vars in GitHub Actions, network failure reaching the OIDC endpoint, or Dagger Cloud rejecting/exchanging the provider token.

Common situations: Running dagger in GitHub Actions without enabling 'permissions: id-token: write' so ACTIONS_ID_TOKEN_REQUEST_TOKEN/URL are empty; running locally where no OIDC env vars exist and no fallback path applies; transient GitHub runner/network outages; Dagger Cloud OIDC endpoint returning a non-token response.

Related errors

• failed to fetch OIDC auth: %w
• vault OIDC login failed: %w
• failed to create GitHub's OIDC request: %w
• failed to request GitHub's OIDC token: %w
• failed to decode GitHub's OIDC token response: %w

AI-assisted analysis of dagger/dagger@82ba2681db (2026-09-05). Data as JSON: /api/errors/c7d1859b10bdb73f. Report an issue: GitHub.