docker/cli · error

unexpected response from Hub

Error message

unexpected response from Hub: %s

What it means

Returned by GetAutoPAT() when POST <audience>/v2/access-tokens/desktop-generate does not return HTTP 201 Created. The response status string is included. This step exchanges the OAuth access token for a Hub auto-generated Personal Access Token after successful device-flow login.

Solutions

1. Retry `docker login` — a transient Hub 5xx usually clears.
2. Check the Hub account is in good standing and can create access tokens in the UI.
3. Update the CLI (audience/endpoint may have moved).
4. Fall back to a manually created PAT (docker login -u <user> with the PAT as password).

Example fix

# before (desktop PAT generation fails)
docker login
# after: use a manual PAT created at hub.docker.com/settings/security
docker login -u myuser
# Password: <paste PAT>

if strings.Contains(err.Error(), "unexpected response from Hub") {
    // fall back to a manual PAT login instead of device-flow auto PAT
}

When it happens

Trigger: Device-flow login succeeded and an access token was issued, but the Hub endpoint that mints the desktop PAT returned an unexpected status (401, 403, 404, 5xx, etc.).

Common situations: Hub account lacks permission / not provisioned for desktop PAT; audience URL misconfigured; Hub service degradation; access token expired between steps; Hub API version change.

Related errors

• failed to get tokens
• failed to decode response
• failed waiting for authentication
• failed to parse token claims
• failed to store tokens

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/ce522d20b050acc2. Report an issue: GitHub.

Appendix: source

Thrown at internal/oauth/api/api.go:245

func (API) GetAutoPAT(ctx context.Context, audience string, res TokenResponse) (string, error) {
	patURL := audience + "/v2/access-tokens/desktop-generate"
	req, err := http.NewRequestWithContext(ctx, http.MethodPost, patURL, nil)
	if err != nil {
		return "", err
	}

	req.Header.Set("Authorization", "Bearer "+res.AccessToken)
	req.Header.Set("Content-Type", "application/json")
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		return "", err
	}
	defer func() {
		_ = resp.Body.Close()
	}()

	if resp.StatusCode != http.StatusCreated {
		return "", fmt.Errorf("unexpected response from Hub: %s", resp.Status)
	}

	var response patGenerateResponse
	err = json.NewDecoder(resp.Body).Decode(&response)
	if err != nil {
		return "", err
	}

	return response.Data.Token, nil
}

type patGenerateResponse struct {
	Data struct {
		Token string `json:"token"`
	}
}

View on GitHub (pinned to 4f84911bfe)