hashicorp/terraform · error

Failed to create API client: %s

Error message

Failed to create API client: %s

What it means

Thrown by the browser token login flow when constructing the TFE API client (tfe.NewClient) with the pasted token fails. The %s carries the client construction error. This is a local validation step before the token is even used to read the user account.

Source

Thrown at internal/command/login.go:657

		Id:     "token",
		Query:  fmt.Sprintf("Token for %s:", hostname.ForDisplay()),
		Secret: true,
	})
	if err != nil {
		diags := diags.Append(fmt.Errorf("Failed to retrieve token: %s", err))
		return "", diags
	}

	token = strings.TrimSpace(token)
	cfg := &tfe.Config{
		Address:  service.String(),
		BasePath: service.Path,
		Token:    token,
		Headers:  make(http.Header),
	}
	client, err := tfe.NewClient(cfg)
	if err != nil {
		diags = diags.Append(fmt.Errorf("Failed to create API client: %s", err))
		return "", diags
	}
	user, err := client.Users.ReadCurrent(context.Background())
	if err == tfe.ErrUnauthorized {
		diags = diags.Append(fmt.Errorf("Token is invalid: %s", err))
		return "", diags
	} else if err != nil {
		diags = diags.Append(fmt.Errorf("Failed to retrieve user account details: %s", err))
		return "", diags
	}
	c.Ui.Output(fmt.Sprintf(c.Colorize().Color("\nRetrieved token for user [bold]%s[reset]\n"), user.Username))

	return svcauth.HostCredentialsToken(token), nil
}

func (c *LoginCommand) interactiveContextConsent(hostname svchost.Hostname, grantType disco.OAuthGrantType, credsCtx *loginCredentialsContext) (bool, tfdiags.Diagnostics) {
	var diags tfdiags.Diagnostics
	mechanism := "OAuth"

View on GitHub (pinned to c9def3e214)

Solutions

1. Verify the hostname resolves to a valid TFC/TFE service (open the service URL in a browser).
2. Check the host's /.well-known/terraform.json service discovery returns sane tfe/v2 endpoints.
3. Re-run `terraform login` ensuring you pasted a complete, non-empty token.
4. Upgrade the Terraform CLI (bundled tfe client) in case NewClient validation changed.

// Validate the resolved service URL before constructing the TFE client.
u, err := url.Parse(service.String())
if err != nil || u.Scheme == "" || u.Host == "" {
    return fmt.Errorf("invalid service URL %q for login", service.String())
}

if _, err := tfe.NewClient(cfg); err != nil {
    // Local client construction failed — verify the service URL and token are well-formed.
    return err
}

When it happens

Trigger: Produced when tfe.NewClient(cfg) returns a non-nil error after the user pastes a token during `terraform login`. Triggered when the service address/base-path configuration is invalid or the tfe client cannot be initialized for the resolved service URL.

Common situations: Malformed service URL discovered via the host's .well-known/terraform.json, an empty/garbage token that violates client validation, or a TFE/Terraform Enterprise installation whose base path/Address is misconfigured. Rarely hit because NewClient does minimal validation.

Related errors

• default workspace not supported You can create a new workspa
• backend does not support key/value tags. Try using key-only
• Remote workspace Terraform version %q does not match local T
• no schema found for %s
• Failed to request username: %s

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/795fa4864d595c4b. Report an issue: GitHub.