netbirdio/netbird · error

failed to create auth client: %v

Error message

failed to create auth client: %v

What it means

auth.NewAuth could not construct the client from the profile config: parsing config.ManagementURL failed (bad scheme, invalid host characters such as underscores, unparseable URL), the stored private key could not be loaded or is invalid, or TLS/PKI material could not be initialized. This fails before any network login attempt is made.

Source

Thrown at client/cmd/login.go:375

		return fmt.Errorf("waiting sso login failed with: %v", err)
	}

	if resp.Email != "" {
		err = pm.SetActiveProfileState(&profilemanager.ProfileState{
			Email: resp.Email,
		})
		if err != nil {
			log.Warnf("failed to set active profile email: %v", err)
		}
	}

	return nil
}

func foregroundLogin(ctx context.Context, cmd *cobra.Command, config *profilemanager.Config, setupKey string, profileID profilemanager.ID) error {
	authClient, err := auth.NewAuth(ctx, config.PrivateKey, config.ManagementURL, config)
	if err != nil {
		return fmt.Errorf("failed to create auth client: %v", err)
	}
	defer authClient.Close()

	needsLogin, err := authClient.IsLoginRequired(ctx)
	if err != nil {
		return fmt.Errorf("check login required: %v", err)
	}

	jwtToken := ""
	if setupKey == "" && needsLogin {
		tokenInfo, err := foregroundGetTokenInfo(ctx, cmd, config, profileID)
		if err != nil {
			return fmt.Errorf("interactive sso login failed: %v", err)
		}
		jwtToken = tokenInfo.GetTokenToUse()
	}

	err, _ = authClient.Login(ctx, setupKey, jwtToken)

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Verify the management URL format: scheme + host + optional port (https://api.netbird.io:443), no underscores in the host
2. Recreate the profile with a corrected URL ('netbird profile create') so a fresh key pair is generated
3. Check that the private key file exists and is readable by the invoking user
4. Confirm NB_MANAGEMENT_URL / related env vars are not overriding the profile with a bad value

Example fix

# before
$ netbird profile create --management-url netbird_mgmt.corp:443
$ netbird login
Error: failed to create auth client: ...

# after: valid scheme, no underscore host
$ netbird profile create --management-url https://netbird-mgmt.corp:443
$ netbird login

// Validate URL shape and key readability before constructing the client
u, err := url.Parse(config.ManagementURL)
if err != nil || (u.Scheme != "http" && u.Scheme != "https") || u.Host == "" || strings.Contains(u.Hostname(), "_") {
    return fmt.Errorf("invalid management URL %q", config.ManagementURL)
}
if _, err := os.Stat(config.PrivateKey); err != nil {
    return fmt.Errorf("private key file unavailable: %w", err)
}

authClient, err := auth.NewAuth(ctx, config.PrivateKey, config.ManagementURL, config)
if err != nil {
    return fmt.Errorf("failed to create auth client: %w", err)
}

When it happens

Trigger: Management URL like netbird_mgmt.corp:443 (underscore host) or missing https:// scheme; corrupted or deleted private key file referenced by the profile; key file unreadable due to permissions; misconfigured NB_ env overriding the management address.

Common situations: Typos when creating the profile ('netbird profile create --management-url ...'); Config copied between machines without the key material; Hostnames with underscores, which Go's url parsing rejects for hosts; Corporate proxies rewriting or blocking the initial connection setup

Related errors

• auth is not supported for TLS services
• check login required: %v
• auth is not supported for TCP/UDP services
• domain is required for TLS services (used for SNI matching)
• listen_port is required for TLS services

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/0225a2a2a5547733. Report an issue: GitHub.