hashicorp/nomad · error

missing login token

Error message

missing login token

What it means

This error is returned by ACLToken's exchange (Login) request validation in nomad/structs/acl.go. When a client performs an ACL Login against an auth method (JWT/OIDC login), the request must carry the JWT obtained from the identity provider. Nomad raises "missing login token" when the LoginToken field of the request is empty. It is a client-side input validation error designed to fail fast before any RPC is processed.

Source

Thrown at nomad/structs/acl.go:2430

	// LoginToken is the 3rd party token that we use to exchange for Nomad ACL
	// Token in order to authenticate. This is a required parameter.
	LoginToken string

	WriteRequest
}

// Validate ensures the request object contains all the required fields in
// order to complete the authentication flow.
func (a *ACLLoginRequest) Validate() error {

	var mErr multierror.Error

	if a.AuthMethodName == "" {
		mErr.Errors = append(mErr.Errors, errors.New("missing auth method name"))
	}
	if a.LoginToken == "" {
		mErr.Errors = append(mErr.Errors, errors.New("missing login token"))
	}
	return mErr.ErrorOrNil()
}

// ACLCreateClientIntroductionTokenRequest is the request object used within the ACL
// client introduction RPC handler. This is used to generate a JWT token that
// can be used to register a new client node into the cluster.
type ACLCreateClientIntroductionTokenRequest struct {

	// TTL is the requested TTL for the identity token. This is an optional
	// parameter and if not set, defaults to the server defined default TTL.
	TTL time.Duration

	// NodeName is the name of the node that is being introduced. This is added
	// to the token as a claim when present, but is optional.
	NodeName string

	// NodePool is the name of the node pool that this node belongs to. This is

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Obtain a JWT from your auth provider and set LoginToken on the ACLLoginRequest (or pass it to `nomad login <jwt>`) before issuing the login request.
2. Verify the token source (env var, file path, cloud metadata) actually produced a non-empty string at the call site.
3. Pre-validate the request client-side: if AuthMethodName is set, assert LoginToken != "" before invoking Login.

Example fix

// before
req := &structs.ACLLoginRequest{
    AuthMethodName: "auth0",
    // LoginToken not set
}
tok, err := aclClient.Login(a, req)

// after
req := &structs.ACLLoginRequest{
    AuthMethodName: "auth0",
    LoginToken:     os.Getenv("OIDC_JWT"),
}
if req.LoginToken == "" {
    return fmt.Errorf("no JWT available for login")
}
tok, err := aclClient.Login(a, req)

if req.AuthMethodName == "" || req.LoginToken == "" {
    return fmt.Errorf("login requires both auth_method_name and login_token")
}

if err := aclClient.Login(a, req); err != nil {
    if strings.Contains(err.Error(), "missing login token") {
        return fmt.Errorf("no JWT supplied: re-run with `nomad login <jwt>`")
    }
    return err
}

When it happens

Trigger: Calling the ACL.Login RPC (or `nomad login` / the HTTP POST /v1/acl/token endpoints for login) with an ACLLoginRequest whose LoginToken field is the empty string. Typical causes: reading the JWT from a file/env var that is unset, or constructing the request programmatically and forgetting to set LoginToken.

Common situations: Automating `nomad login` in CI where the OIDC/JWT token variable was not exported; passing the wrong struct field (e.g. setting AuthMethodName but leaving LoginToken empty); using an API client wrapper that drops the token field on serialization.

Related errors

• no auth method config or client assertion
• JWT auth method requires either OIDCDiscoveryURL, or JWKS UR
• ACL token not found
• failed to login with JWT: %v
• ACL token not found or invalid workload identity: %v

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/2a6555ae0bb17e1c. Report an issue: GitHub.