larksuite/cli · error

failed to get HTTP client for user_info: %w

Error message

failed to get HTTP client for user_info: %w

What it means

After a UAT is successfully resolved, the provider must verify the user's identity with an HTTP call to the user_info endpoint. Building that HTTP client failed, so identity verification cannot proceed and the error is wrapped and propagated. This is an infrastructure failure (client construction), not a token or API failure.

Source

Thrown at internal/credential/credential_provider.go:243

func (p *CredentialProvider) enrichUserInfo(ctx context.Context, acct *Account, source credentialSource) error {
	if p.httpClient == nil || source == nil {
		return nil
	}
	tok, found, err := source.TryResolveToken(ctx, TokenSpec{Type: TokenTypeUAT, AppID: acct.AppID})
	if err != nil {
		var blockErr *extcred.BlockError
		if errors.As(err, &blockErr) {
			return nil // provider explicitly blocks UAT; skip enrichment
		}
		return fmt.Errorf("failed to resolve UAT for user identity verification: %w", err)
	}
	if !found {
		return nil
	}
	// Have UAT — must verify and resolve identity
	hc, err := p.httpClient()
	if err != nil {
		return fmt.Errorf("failed to get HTTP client for user_info: %w", err)
	}
	requestCtx := core.WithCredentialSource(ctx, tok.Source)
	info, err := fetchUserInfo(requestCtx, hc, acct.Brand, tok.Token)
	if err != nil {
		return fmt.Errorf("failed to verify user identity: %w", err)
	}
	acct.UserOpenId = info.OpenID
	acct.UserName = info.Name
	return nil
}

func (p *CredentialProvider) selectedCredentialSource(ctx context.Context) (credentialSource, error) {
	if p.selectedSource != nil {
		return p.selectedSource, nil
	}
	if p.defaultAcct == nil {
		return nil, nil
	}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Inspect the wrapped cause from p.httpClient() and fix the HTTP client construction inputs: proxy settings (HTTPS_PROXY/HTTP_PROXY), CA bundle paths, TLS config
2. Verify network environment variables resolve to valid URLs and that the CA file exists and is readable
3. Once the transport issue is fixed, re-run the command; no re-auth is needed since the UAT itself resolved fine

Example fix

// before (env)
HTTPS_PROXY="not a url"
// after
HTTPS_PROXY="http://proxy.corp.example:8080"

// Fail fast on bad proxy/CA env before any API call
if p := os.Getenv("HTTPS_PROXY"); p != "" {
	if _, err := url.Parse(p); err != nil {
		return fmt.Errorf("invalid HTTPS_PROXY %q: %w", p, err)
	}
}
if ca := os.Getenv("SSL_CERT_FILE"); ca != "" {
	if _, err := os.Stat(ca); err != nil {
		return fmt.Errorf("CA bundle missing: %w", err)
	}
}

acct, err := provider.ResolveAccount(ctx)
if err != nil && strings.Contains(err.Error(), "failed to get HTTP client for user_info") {
	// transport config problem — inspect and fix proxy/CA settings, then retry
}

When it happens

Trigger: p.httpClient() returns an error after TryResolveToken reported a UAT found=true — e.g. TLS/proxy/transport configuration cannot be initialized (bad proxy URL, missing CA bundle, invalid transport settings).

Common situations: Corporate proxy configured with an invalid URL; custom CA/certificate setup broken; environment (HTTPS_PROXY, SSL cert paths) pointing at unusable values while a UAT-bearing credential source is active.

Related errors

• invalid HTTPS proxy address: %w
• proxy plugin enabled but config is invalid: %w
• redirect from https to http is not allowed
• only https URLs are supported
• annotated_csv did not parse into the rows the server reporte

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/b8e9f5b9089a8bd6. Report an issue: GitHub.