What causes "Failed to retrieve user account details: %s" in hashicorp/terraform?

Check network connectivity to the service host (curl the API base URL).

Failed to retrieve user account details: %s

Error message

Failed to retrieve user account details: %s

What it means

Thrown by the browser token login flow when client.Users.ReadCurrent returns any error OTHER than tfe.ErrUnauthorized. The %s carries the underlying API/network error. The token was accepted by the client but the user-read API call failed for a non-auth reason.

Source

Thrown at internal/command/login.go:665

	token = strings.TrimSpace(token)
	cfg := &tfe.Config{
		Address:  service.String(),
		BasePath: service.Path,
		Token:    token,
		Headers:  make(http.Header),
	}
	client, err := tfe.NewClient(cfg)
	if err != nil {
		diags = diags.Append(fmt.Errorf("Failed to create API client: %s", err))
		return "", diags
	}
	user, err := client.Users.ReadCurrent(context.Background())
	if err == tfe.ErrUnauthorized {
		diags = diags.Append(fmt.Errorf("Token is invalid: %s", err))
		return "", diags
	} else if err != nil {
		diags = diags.Append(fmt.Errorf("Failed to retrieve user account details: %s", err))
		return "", diags
	}
	c.Ui.Output(fmt.Sprintf(c.Colorize().Color("\nRetrieved token for user [bold]%s[reset]\n"), user.Username))

	return svcauth.HostCredentialsToken(token), nil
}

func (c *LoginCommand) interactiveContextConsent(hostname svchost.Hostname, grantType disco.OAuthGrantType, credsCtx *loginCredentialsContext) (bool, tfdiags.Diagnostics) {
	var diags tfdiags.Diagnostics
	mechanism := "OAuth"
	if grantType == "" {
		mechanism = "your browser"
	}

	c.Ui.Output(fmt.Sprintf("Terraform will request an API token for %s using %s.\n", hostname.ForDisplay(), mechanism))

	if grantType.UsesAuthorizationEndpoint() {
		c.Ui.Output(

View on GitHub (pinned to c9def3e214)

Solutions

Check network connectivity to the service host (curl the API base URL).
Verify TLS/proxy settings: set HTTPS_PROXY and ensure corporate CAs are trusted.
Retry the login; transient 5xx/network errors often resolve.
Confirm the TFE instance is up and the /api/v2/users/current endpoint responds (for self-hosted TFE).

Defensive patterns

Strategy: retry

Validate before calling

// Check connectivity to the API before login to surface network issues early.
resp, err := http.Get(service.String() + "/api/v2/ping")
if err != nil || resp.StatusCode >= 500 {
    return fmt.Errorf("TFC/TFE API unreachable: %v", err)
}

Try / catch

var u *tfe.User
err := backoff.Retry(func() error {
    var e error
    u, e = client.Users.ReadCurrent(ctx)
    return e
}, backoff.NewExponentialBackOff())
if err != nil && !errors.Is(err, tfe.ErrUnauthorized) {
    // Non-auth failure — network/service issue; advise checking connectivity/TLS.
}

Prevention

Verify HTTPS connectivity and proxy/TLS config before running login.
Retry on transient 5xx/network errors before treating login as failed.
For self-hosted TFE, confirm the instance and /api/v2 are healthy.

When it happens

Trigger: Produced during `terraform login` when client.Users.ReadCurrent returns an error that is not ErrUnauthorized. Triggered by network failures, TFE API outages, TLS issues, 5xx responses, or rate limiting when reading the current user.

Common situations: Network connectivity issues to TFC/TFE, corporate proxy/TLS interception breaking the connection, TFE instance temporarily unavailable, API rate limiting, or a TFE version whose /api/v2/users/current endpoint behaves differently.

Related errors

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/ee02c07acbc95a96. Report an issue: GitHub.