hashicorp/packer · error · ClientError

InvalidClientConfig

InvalidClientConfig

Error message

Failed to check for HCP auth, error: %s

What it means

NewClient in internal/hcp/api first asks env.HasHCPAuth() whether HCP credentials are present. If that check itself returns an error (as opposed to simply reporting no auth), the client returns a ClientError with StatusCode InvalidClientConfig wrapping `Failed to check for HCP auth, error: %s`. This distinguishes an error while inspecting the environment/credential file from the plain not-configured case.

Source

Thrown at internal/hcp/api/client.go:43

	Packer       packerSvc.ClientService
	Organization organizationSvc.ClientService
	Project      projectSvc.ClientService

	// OrganizationID  is the organization unique identifier on HCP.
	OrganizationID string

	// ProjectID  is the project unique identifier on HCP.
	ProjectID string
}

// NewClient returns an authenticated client to a HCP Packer Registry.
// Upon error a HCPClientError will be returned.
func NewClient() (*Client, error) {
	hasAuth, err := env.HasHCPAuth()
	if err != nil {
		return nil, &ClientError{
			StatusCode: InvalidClientConfig,
			Err:        fmt.Errorf("Failed to check for HCP auth, error: %s", err.Error()),
		}
	}
	if !hasAuth {
		return nil, &ClientError{
			StatusCode: InvalidClientConfig,
			Err:        fmt.Errorf("HCP Authentication not configured, either set an HCP Client ID and secret using the environment variables %s and %s, place an HCP credential file in the default path (%s), or at a different path specified in the %s environment variable.", env.HCPClientID, env.HCPClientSecret, env.HCPDefaultCredFilePathFull, env.HCPCredFile),
		}
	}

	hcpClientCfg := httpclient.Config{
		SourceChannel: fmt.Sprintf("packer/%s", version.PackerVersion.FormattedVersion()),
	}
	if err := hcpClientCfg.Canonicalize(); err != nil {
		return nil, &ClientError{
			StatusCode: InvalidClientConfig,
			Err:        err,
		}
	}

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Inspect the wrapped inner error to see which credential source failed and fix that file/path
2. Point HCP_CREDENTIAL_FILE to a valid, readable credential file, or unset it to fall back to the default path
3. Prefer setting HCP_CLIENT_ID and HCP_CLIENT_SECRET env vars, which avoids credential-file reading
4. Recreate the credential file via `hcp auth login` if it is corrupt

Example fix

// before: broken custom credential file
export HCP_CREDENTIAL_FILE=/path/corrupt.json
// after: use explicit env credentials
export HCP_CLIENT_ID=...
export HCP_CLIENT_SECRET=...

// Pre-check the credential file is readable JSON before constructing the client
if p := os.Getenv("HCP_CREDENTIAL_FILE"); p != "" {
    f, err := os.Open(p)
    if err != nil { return fmt.Errorf("HCP credential file unreadable: %w", err) }
    f.Close()
}

client, err := hcpapi.NewClient()
var ce *hcpapi.ClientError
if errors.As(err, &ce) && ce.StatusCode == hcpapi.InvalidClientConfig {
    return fmt.Errorf("HCP auth check failed: %v", ce.Err)
}

When it happens

Trigger: NewDeprecatedClient → NewClient runs env.HasHCPAuth(), which errors while reading the HCP credential file at the default or HCP_CREDENTIAL_FILE path (malformed file, permission error) or while evaluating the auth environment variables.

Common situations: HCP_CREDENTIAL_FILE points to a corrupt/unreadable credential file; permission denied on ~/.config/hcp/; an env-var read failing in a restricted environment.

Related errors

• initialize KMS signer %q: %w
• unexpected number of organizations: expected 1, actual: %v
• unable to fetch project list: %v
• no project found
• No active HCP Packer registry was found for the organization

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/c39212d1bff2cb8b. Report an issue: GitHub.