docker/cli · error

failed to get tokens

Error message

failed to get tokens: %w

What it means

Returned by getDeviceToken() when the HTTP POST (postForm) to <TenantURL>/oauth/token fails at the transport layer (DNS, TLS, connection refused, timeout — the call has a 1 minute context timeout). The %w wraps the underlying net/http error. This is the device-code grant token exchange step of the Docker Hub OAuth device flow.

Solutions

1. Verify network connectivity to the OAuth tenant host (curl -v <TenantURL>/oauth/token).
2. Configure proxy / trusted CA for the CLI (HTTP_PROXY/HTTPS_PROXY and system trust store).
3. Retry — the failure is wrapped and the device flow can be re-initiated.
4. Check system clock sync (NTP) to avoid TLS handshake failures.

Example fix

# before: no proxy, blocked
docker login
# after
export HTTPS_PROXY=http://corp-proxy:3128
export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
docker login

// validate reachability before starting the device flow
if err := probeOAuthTenant(ctx, tenantURL); err != nil { return err }

var ue *url.Error
if errors.As(err, &ue) { /* network/transport — retry with backoff */ }
if errors.Is(err, context.DeadlineExceeded) { /* extend timeout or re-init flow */ }

When it happens

Trigger: Calling the Hub OAuth device-flow token endpoint and the request never completes: no network, corporate proxy blocking login.docker.com / *.auth0.com, TLS interception, or the 1-minute context deadline elapsing.

Common situations: Offline or firewalled environments; corporate MITM proxies without trusted CA; misconfigured TenantURL; clock skew breaking TLS; transient outage of the Auth0 tenant.

Related errors

• failed to decode response
• unexpected response from Hub
• failed waiting for authentication
• credentials erased successfully, but there was a failure to…
• failed to parse token claims

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/18af662c1a1a4a0c. Report an issue: GitHub.

Appendix: source

Thrown at internal/oauth/api/api.go:172

	}
	t.Reset(d)
}

// getDeviceToken calls the token endpoint of Auth0 and returns the response.
func (a API) getDeviceToken(ctx context.Context, state State) (TokenResponse, error) {
	ctx, cancel := context.WithTimeout(ctx, 1*time.Minute)
	defer cancel()

	data := url.Values{
		"client_id":   {a.ClientID},
		"grant_type":  {"urn:ietf:params:oauth:grant-type:device_code"},
		"device_code": {state.DeviceCode},
	}
	oauthTokenURL := a.TenantURL + "/oauth/token"

	resp, err := postForm(ctx, oauthTokenURL, strings.NewReader(data.Encode()))
	if err != nil {
		return TokenResponse{}, fmt.Errorf("failed to get tokens: %w", err)
	}
	defer func() {
		_ = resp.Body.Close()
	}()

	// this endpoint returns a 403 with an `authorization_pending` error until the
	// user has authenticated, so we don't check the status code here and instead
	// decode the response and check for the error.
	var res TokenResponse
	err = json.NewDecoder(resp.Body).Decode(&res)
	if err != nil {
		return res, fmt.Errorf("failed to decode response: %w", err)
	}

	return res, nil
}

// RevokeToken revokes a refresh token with the tenant so that it can no longer

View on GitHub (pinned to 4f84911bfe)