hashicorp/terraform · error

Failed to request password: %s

Error message

Failed to request password: %s

What it means

Thrown by the login command's password-grant flow when the UI input call requesting the password fails (after the username was already collected). The %s carries the input error. It aborts the OAuth password-grant login before the token request.

Source

Thrown at internal/command/login.go:561

	c.Ui.Output("\n---------------------------------------------------------------------------------\n")
	c.Ui.Output("Terraform must temporarily use your password to request an API token.\nThis password will NOT be saved locally.\n")

	username, err := c.UIInput().Input(context.Background(), &terraform.InputOpts{
		Id:    "username",
		Query: fmt.Sprintf("Username for %s:", hostname.ForDisplay()),
	})
	if err != nil {
		diags = diags.Append(fmt.Errorf("Failed to request username: %s", err))
		return nil, diags
	}
	password, err := c.UIInput().Input(context.Background(), &terraform.InputOpts{
		Id:     "password",
		Query:  fmt.Sprintf("Password for %s:", hostname.ForDisplay()),
		Secret: true,
	})
	if err != nil {
		diags = diags.Append(fmt.Errorf("Failed to request password: %s", err))
		return nil, diags
	}

	oauthConfig := &oauth2.Config{
		ClientID: clientConfig.ID,
		Endpoint: clientConfig.Endpoint(),
		Scopes:   clientConfig.Scopes,
	}
	token, err := oauthConfig.PasswordCredentialsToken(context.Background(), username, password)
	if err != nil {
		// FIXME: The OAuth2 library generates errors that are not appropriate
		// for a Terraform end-user audience, so once we have more experience
		// with which errors are most common we should try to recognize them
		// here and produce better error messages for them.
		diags = diags.Append(tfdiags.Sourceless(
			tfdiags.Error,
			"Failed to retrieve API token",
			fmt.Sprintf("The remote host did not issue an API token: %s.", err),

View on GitHub (pinned to c9def3e214)

Solutions

1. Run `terraform login` in an interactive terminal with a TTY and do not use -input=false.
2. Use the browser token flow instead: create a token in the UI and write it to the credentials file directly.
3. Ensure the terminal supports reading a hidden/secret input (some minimal shells/embedded terminals do not).
4. If automating, configure credentials via a credentials helper or the credentials file rather than the interactive login.

// Verify the terminal can read secret input before starting the password-grant flow.
if !term.IsTerminal(int(os.Stdin.Fd())) {
    return errors.New("cannot read password interactively: provide credentials non-interactively")
}

if _, err := cmd.PasswordPrompt(); err != nil {
    // Secret input failed — abort and instruct user to set credentials manually.
    return err
}

When it happens

Trigger: Produced when c.UIInput().Input() returns a non-nil error for the 'password' (Secret) prompt during `terraform login` on a host advertising the OAuth password grant. Triggered when interactive secret input is unavailable or fails mid-flow.

Common situations: Same as 633: non-TTY environment, -input=false, closed stdin, or a custom UI input that errors on the secret prompt. Also seen if the terminal is lost between the username and password prompts.

Related errors

• Failed to request username: %s
• Failed to retrieve token: %s
• Error asking %s: %v
• Login cancelled
• interrupted

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/2fcef9e0ae710461. Report an issue: GitHub.