hashicorp/terraform · error

mismatch between supplied OIDC token and supplied OIDC token

Error message

mismatch between supplied OIDC token and supplied OIDC token file contents - please either remove one or ensure they match

What it means

getOidcToken (helpers.go:57) detects that both `oidc_token` (inline) and `oidc_token_file_path` (file) were supplied and, after trimming whitespace, the two resolved token values differ. The backend refuses to guess which credential to use, so a divergence is treated as a hard misconfiguration.

Source

Thrown at internal/backend/remote-state/azure/helpers.go:57

		pfx = out[:n]
	}
	return pfx, nil
}

func getOidcToken(d *backendbase.SDKLikeData) (*string, error) {
	idToken := strings.TrimSpace(d.String("oidc_token"))

	if path := d.String("oidc_token_file_path"); path != "" {
		fileTokenRaw, err := os.ReadFile(path)

		if err != nil {
			return nil, fmt.Errorf("reading OIDC Token from file %q: %v", path, err)
		}

		fileToken := strings.TrimSpace(string(fileTokenRaw))

		if idToken != "" && idToken != fileToken {
			return nil, fmt.Errorf("mismatch between supplied OIDC token and supplied OIDC token file contents - please either remove one or ensure they match")
		}

		idToken = fileToken
	}

	if d.Bool("use_aks_workload_identity") && os.Getenv("AZURE_FEDERATED_TOKEN_FILE") != "" {
		path := os.Getenv("AZURE_FEDERATED_TOKEN_FILE")
		fileTokenRaw, err := os.ReadFile(os.Getenv("AZURE_FEDERATED_TOKEN_FILE"))

		if err != nil {
			return nil, fmt.Errorf("reading OIDC Token from file %q provided by AKS Workload Identity: %v", path, err)
		}

		fileToken := strings.TrimSpace(string(fileTokenRaw))

		if idToken != "" && idToken != fileToken {
			return nil, fmt.Errorf("mismatch between supplied OIDC token and OIDC token file contents provided by AKS Workload Identity - please either remove one, ensure they match, or disable use_aks_workload_identity")
		}

View on GitHub (pinned to c9def3e214)

Solutions

1. Provide only ONE of oidc_token or oidc_token_file_path and remove the other.
2. If both must remain, make the inline value byte-identical (after trimming whitespace) to the file contents.
3. Re-export the correct token into whichever single source you intend to keep.

Example fix

# before
terraform {
  backend "azurerm" {
    oidc_token           = "eyJhbGci...OLD"
    oidc_token_file_path = "/etc/tf/token"   # contains NEW token
  }
}
# after
terraform {
  backend "azurerm" {
    oidc_token_file_path = "/etc/tf/token"
  }
}

# ensure inline oidc_token matches the file, or only one is set
tok="${TF_VAR_oidc_token:-}"
file="${TF_VAR_oidc_token_file_path:-}"
if [ -n "$tok" ] && [ -n "$file" ]; then
  ft="$(tr -d '[:space:]' < "$file")"
  t="$(printf '%s' "$tok" | tr -d '[:space:]')"
  [ "$t" = "$ft" ] || { echo "oidc token / file mismatch" >&2; exit 1; }
fi

When it happens

Trigger: Setting both oidc_token and oidc_token_file_path in the backend block (or via the corresponding env vars) such that the inline token and the file's contents are not byte-equal after trimming.

Common situations: Token rotation where only one of the two sources was updated; a leftover oidc_token env var while the file path was changed; copy-paste drift between the two sources.

Related errors

• reading OIDC Token from file %q: %v
• mismatch between supplied OIDC token and OIDC token file con
• reading Client ID from file %q: %v
• mismatch between supplied Client ID and supplied Client ID f
• reading Client Secret from file %q: %v

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/87044e3786690237. Report an issue: GitHub.