netbirdio/netbird · error

check login required: %v

Error message

check login required: %v

What it means

authClient.IsLoginRequired(ctx) failed: the probe request to management (checking whether the peer's key is already registered) errored at the transport or HTTP level. Causes: management host/port unreachable, DNS resolution failure, TLS verification failure (self-signed cert not trusted by the client), or a server-side 5xx.

Source

Thrown at client/cmd/login.go:381

		})
		if err != nil {
			log.Warnf("failed to set active profile email: %v", err)
		}
	}

	return nil
}

func foregroundLogin(ctx context.Context, cmd *cobra.Command, config *profilemanager.Config, setupKey string, profileID profilemanager.ID) error {
	authClient, err := auth.NewAuth(ctx, config.PrivateKey, config.ManagementURL, config)
	if err != nil {
		return fmt.Errorf("failed to create auth client: %v", err)
	}
	defer authClient.Close()

	needsLogin, err := authClient.IsLoginRequired(ctx)
	if err != nil {
		return fmt.Errorf("check login required: %v", err)
	}

	jwtToken := ""
	if setupKey == "" && needsLogin {
		tokenInfo, err := foregroundGetTokenInfo(ctx, cmd, config, profileID)
		if err != nil {
			return fmt.Errorf("interactive sso login failed: %v", err)
		}
		jwtToken = tokenInfo.GetTokenToUse()
	}

	err, _ = authClient.Login(ctx, setupKey, jwtToken)
	if err != nil {
		return fmt.Errorf("login failed: %v", err)
	}

	return nil
}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Test reachability directly: curl -v https://<management-url> from the same host
2. Fix the address/DNS or open the firewall path to management
3. For self-signed deployments, import the CA on the client or issue a properly signed certificate; verify cert validity dates
4. Wait for management to report healthy, then retry the login

Example fix

# before
Error: check login required: Get "https://mgr.corp/api/...": x509: certificate signed by unknown authority

# after: trust the private CA on the host, then retry
$ sudo cp corp-root-ca.crt /usr/local/share/ca-certificates/
$ sudo update-ca-certificates
$ netbird login

// Cheap pre-flight: management must answer before asking about login
req, _ := http.NewRequest(http.MethodGet, config.ManagementURL, nil)
if _, err := http.DefaultClient.Do(req); err != nil {
    return fmt.Errorf("management unreachable: %w", err)
}

var needsLogin bool
err := backoff.Retry(func() error {
    var e error
    needsLogin, e = authClient.IsLoginRequired(ctx)
    return e
}, backoff.WithMaxRetries(backoff.NewConstantBackOff(time.Second), 3))
if err != nil {
    return fmt.Errorf("check login required: %w", err)
}

When it happens

Trigger: Wrong management address in the profile; firewall or egress rules blocking the port; management service down or restarting; self-signed management certificate without the CA imported; system clock skew breaking TLS validity; DNS entry missing.

Common situations: Management instance not yet up after a restart or upgrade; Private CA not distributed to new hosts so x509 verification fails; VPN/egress changes severing the path to management; Certificates expired on a self-hosted management deployment

Related errors

• failed to create auth client: %v
• auth is not supported for TLS services
• failed to create auth client: %v
• startup check: management not connected
• create auth client: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/95690034f06cf57d. Report an issue: GitHub.