netbirdio/netbird · error

failed to create auth client: %v

Error message

failed to create auth client: %v

What it means

extendAuthSession calls auth.NewAuth to build the management gRPC client used for the SSO token exchange, and this wraps its failure. NewAuth fails in two places: parsing the WireGuard private key from the stored config (wgtypes.ParseKey), or dialing the management service (mgm.NewClient) with the configured URL and TLS scheme. The error therefore means either the stored identity is corrupt or management is not reachable.

Source

Thrown at client/android/session.go:292

	if c.extendCancel != nil {
		c.extendCancel()
		c.extendCancel = nil
	}
}

func (c *Client) extendAuthSession(ctx context.Context, urlOpener URLOpener, isAndroidTV bool) error {
	cfg, cfgPath, cc := c.authSnapshot()
	if cfg == nil || cc == nil {
		return fmt.Errorf("engine is not running")
	}
	engine := cc.Engine()
	if engine == nil {
		return fmt.Errorf("engine is not initialized")
	}

	authClient, err := auth.NewAuth(ctx, cfg.PrivateKey, cfg.ManagementURL, cfg)
	if err != nil {
		return fmt.Errorf("failed to create auth client: %v", err)
	}
	defer authClient.Close()

	// Passing the config path makes the flow pick up the login_hint: an extend
	// renews the session of the account already signed in, so it must not stop to
	// offer a choice.
	a := NewAuthWithConfig(ctx, cfg, cfgPath)
	tokenInfo, err := a.foregroundGetTokenInfo(authClient, urlOpener, isAndroidTV)
	if err != nil {
		return fmt.Errorf("interactive sso login failed: %v", err)
	}

	if _, err := engine.ExtendAuthSession(ctx, tokenInfo.GetTokenToUse()); err != nil {
		return err
	}
	c.clearLoginRequired()

	go urlOpener.OnLoginSuccess()

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Verify the device can reach the configured management URL (curl https://<mgmt-host> from the device network; check DNS and port)
2. Inspect the stored profile: the management URL must be valid and the private key present — if the store is corrupt, log out and re-login (re-register the client) to regenerate it
3. If TLS is the cause (cert verify errors in log), renew/install the management certificate and ensure the Android trust store accepts it
4. Retry once the network is back — a transient dial failure surfaces through this same error

Example fix

// before: failing on corrupt key silently stored after a partial write
authClient, err := auth.NewAuth(ctx, cfg.PrivateKey, cfg.ManagementURL, cfg)

// after: fail fast with an actionable distinction between key and dial errors
if _, keyErr := wgtypes.ParseKey(cfg.PrivateKey); keyErr != nil {
    return fmt.Errorf("stored private key is invalid, re-register the client: %v", keyErr)
}
authClient, err := auth.NewAuth(ctx, cfg.PrivateKey, cfg.ManagementURL, cfg)

// Before extend, verify the key parses and management answers:
if _, err := wgtypes.ParseKey(cfg.PrivateKey); err != nil {
    return fmt.Errorf("re-register needed: %v", err)
}
if _, err := net.DialTimeout("tcp", cfg.ManagementURL.Host, 3*time.Second); err != nil {
    return fmt.Errorf("management unreachable: %v", err)
}

// Retry once after connectivity returns; surface persistent key errors as re-register:
client, err := auth.NewAuth(ctx, key, url, cfg)
if err != nil {
    if !isTransient(err) { // key parse errors are permanent
        return permanentErr(err)
    }
    time.Sleep(backoff)
    client, err = auth.NewAuth(ctx, key, url, cfg)
    if err != nil { return err }
}

When it happens

Trigger: cfg.PrivateKey in the profile store is empty, truncated, or not a valid base64 WireGuard key (66 chars, base64-encoded); cfg.ManagementURL unreachable: DNS failure, management server down, firewall blocking the port, self-signed cert on an https:// URL without the configured trust; proxy or captive portal intercepting the connection on Android.

Common situations: Corrupted config after an app update or incomplete migration of the profile store; management hostname changed or on-prem management stopped; device offline (airplane mode, network switch) when the expiry warning triggered an extend; TLS certificate rotated and the Android system trust store rejects it.

Related errors

• check login required: %v
• failed to create auth client: %v
• failed to check SSO support: %v
• login failed: %v
• failed to check login requirement: %v

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/57e8ec9c41b5838c. Report an issue: GitHub.