hashicorp/terraform · error

failed to determine request credentials: %s

Error message

failed to determine request credentials: %s

What it means

At the start of each GET, get() calls mirrorHostCredentials() to load any host credentials. If that lookup fails (e.g. because the base URL host is invalid, producing the 889 error) it is wrapped with this message. It is a credentials-resolution failure, not an HTTP failure — the request was never sent.

Source

Thrown at internal/getproviders/http_mirror_source.go:341

// produced the returned response, possibly after following some redirects.
func (s *HTTPMirrorSource) get(ctx context.Context, relativePath string) (statusCode int, body io.ReadCloser, finalURL *url.URL, error error) {
	endpointPath, err := url.Parse(relativePath)
	if err != nil {
		// Should never happen because the caller should validate all of the
		// components it's including in the path.
		return 0, nil, nil, err
	}
	endpointURL := s.baseURL.ResolveReference(endpointPath)

	req, err := retryablehttp.NewRequest("GET", endpointURL.String(), nil)
	if err != nil {
		return 0, nil, endpointURL, err
	}
	req = req.WithContext(ctx)
	req.Request.Header.Set(terraformVersionHeader, version.String())
	creds, err := s.mirrorHostCredentials()
	if err != nil {
		return 0, nil, endpointURL, fmt.Errorf("failed to determine request credentials: %s", err)
	}
	if creds != nil {
		// Note that if the initial requests gets redirected elsewhere
		// then the credentials will still be included in the new request,
		// even if they are on a different hostname. This is intentional
		// and consistent with how we handle credentials for other
		// Terraform-native services, because the user model is to configure
		// credentials for the "friendly hostname" they configured, not for
		// whatever hostname ends up ultimately serving the request as an
		// implementation detail.
		creds.PrepareRequest(req.Request)
	}

	resp, err := s.httpClient.Do(req)
	if err != nil {
		return 0, nil, endpointURL, err
	}
	defer func() {

View on GitHub (pinned to c9def3e214)

Solutions

1. Fix the mirror base URL hostname (see the wrapped error, often the 889 IDNA failure).
2. Verify the credentials source / helper returns cleanly for the mirror host.
3. Remove the creds block for the host if none is needed, to isolate the cause.

Example fix

# before
credentials "tf_mirror.local" { token = "..." }  # host won't normalize
provider_installation { network_mirror { url = "https://tf_mirror.local/" } }

# after
credentials "tf-mirror.local" { token = "..." }
provider_installation { network_mirror { url = "https://tf-mirror.local/" } }

// Resolve mirror credentials once at startup, before any request.
host, err := svchost.FromURL(mirrorURL)
if err != nil { return fmt.Errorf("bad mirror host: %w", err) }
if creds != nil { if _, err := creds.ForHost(host); err != nil { return err } }

When it happens

Trigger: Any mirror request when the base URL hostname is invalid and a credentials source is configured, or when the credentials source itself returns an error from ForHost. The request is aborted before dialing.

Common situations: Invalid mirror hostname combined with a creds block; a credentials helper/plugin that errors for the mirror host; misconfigured base URL port.

Related errors

• invalid provider mirror base URL %s: %s
• invalid credentials for %s
• Error loading credentials: %s
• the string provided in credentials is neither valid json nor
• unable to initialize the location client: %#v

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/5280b0fed5c7b060. Report an issue: GitHub.