netbirdio/netbird · error

could not create a code verifier: %v

Error message

could not create a code verifier: %v

What it means

Returned by PKCEAuthorizationFlow.RequestAuthInfo when randomBytesInHex(64) fails while generating the PKCE code verifier (client/internal/auth/pkce_flow.go:143-146). Same mechanism as error 937: io.ReadFull on crypto/rand.Reader returned an error, so the 64-byte verifier could not be produced and the flow cannot proceed (S256 code challenge is derived from this verifier).

Source

Thrown at client/internal/auth/pkce_flow.go:145

	}, nil
}

// GetClientID returns the provider client id
func (p *PKCEAuthorizationFlow) GetClientID(_ context.Context) string {
	return p.providerConfig.ClientID
}

// RequestAuthInfo requests a authorization code login flow information.
func (p *PKCEAuthorizationFlow) RequestAuthInfo(ctx context.Context) (AuthFlowInfo, error) {
	state, err := randomBytesInHex(24)
	if err != nil {
		return AuthFlowInfo{}, fmt.Errorf("could not generate random state: %v", err)
	}
	p.state = state

	codeVerifier, err := randomBytesInHex(64)
	if err != nil {
		return AuthFlowInfo{}, fmt.Errorf("could not create a code verifier: %v", err)
	}
	p.codeVerifier = codeVerifier

	codeChallenge := createCodeChallenge(codeVerifier)

	params := []oauth2.AuthCodeOption{
		oauth2.SetAuthURLParam("code_challenge_method", "S256"),
		oauth2.SetAuthURLParam("code_challenge", codeChallenge),
		oauth2.SetAuthURLParam("audience", p.providerConfig.Audience),
	}
	if !p.providerConfig.DisablePromptLogin {
		switch p.providerConfig.LoginFlag {
		case common.LoginFlagPromptLogin:
			params = append(params, oauth2.SetAuthURLParam("prompt", "login"))
		case common.LoginFlagMaxAge0:
			params = append(params, oauth2.SetAuthURLParam("max_age", "0"))
		}
	}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Verify host entropy availability and retry after the system warms up
2. Provide hardware/virtio RNG to guests; upgrade the kernel
3. Check that the security policy permits random-number syscalls for the agent process

if err != nil && strings.Contains(err.Error(), "could not create a code verifier") {
	// same class as 937: crypto/rand failed; fix host entropy and retry the flow
}

When it happens

Trigger: Identical to 937 but at the verifier step, immediately after the state was generated successfully: crypto/rand exhaustion or blocking occurs between the two reads, or the entropy source fails outright at this call.

Common situations: Same rare host environments as 937: entropy-starved VMs/containers, sandboxed runtimes blocking getrandom. Seeing 937 and 938 together confirms a host entropy problem rather than transient noise.

Related errors

• could not generate random state: %v
• could not generate %d random bytes: %v
• generate root key: %w
• %s %s
• failed to create artifact key: %w

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/0b8d1449339ca022. Report an issue: GitHub.