netbirdio/netbird · error

failed to create auth client: %v

Error message

failed to create auth client: %v

What it means

In the Android login flow, saveConfigIfSSOSupported builds the management auth client with auth.NewAuth(ctx, privateKey, managementURL, ...). Failure while creating the gRPC client or preparing the key pair is wrapped as this error. Note the wrap uses %v, so the original cause is flattened into the message and cannot be matched with errors.Is.

Source

Thrown at client/android/login.go:94

// SaveConfigIfSSOSupported test the connectivity with the management server by retrieving the server device flow info.
// If it returns a flow info than save the configuration and return true. If it gets a codes.NotFound, it means that SSO
// is not supported and returns false without saving the configuration. For other errors return false.
func (a *Auth) SaveConfigIfSSOSupported(listener SSOListener) {
	go func() {
		sso, err := a.saveConfigIfSSOSupported()
		if err != nil {
			listener.OnError(err)
		} else {
			listener.OnSuccess(sso)
		}
	}()
}

func (a *Auth) saveConfigIfSSOSupported() (bool, error) {
	authClient, err := auth.NewAuth(a.ctx, a.config.PrivateKey, a.config.ManagementURL, a.config)
	if err != nil {
		return false, fmt.Errorf("failed to create auth client: %v", err)
	}
	defer authClient.Close()

	supportsSSO, err := authClient.IsSSOSupported(a.ctx)
	if err != nil {
		return false, fmt.Errorf("failed to check SSO support: %v", err)
	}

	if !supportsSSO {
		return false, nil
	}

	err = profilemanager.WriteOutConfig(a.cfgPath, a.config)
	return true, err
}

// LoginWithSetupKeyAndSaveConfig test the connectivity with the management server with the setup key.
func (a *Auth) LoginWithSetupKeyAndSaveConfig(resultListener ErrListener, setupKey string, deviceName string) {

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Verify the management URL is reachable from the device (scheme, host, port).
2. Check that the management TLS certificate chains to a CA the device trusts.
3. Read the message text after the colon for the cause; if maintaining this code, switch %v to %w so callers can inspect the cause.

Example fix

// before (error cause lost)
return false, fmt.Errorf("failed to create auth client: %v", err)

// after (cause preserved)
return false, fmt.Errorf("create auth client: %w", err)

func isAuthClientCreateFailure(err error) bool {
    return err != nil && strings.HasPrefix(err.Error(), "failed to create auth client:")
}

sso, err := a.saveConfigIfSSOSupported()
if err != nil {
    if isAuthClientCreateFailure(err) {
        // management URL / TLS / key problem: check connectivity and cert
        // trust before retrying; cause is string-formatted (%v), not wrapped
    }
    listener.OnError(err)
}

When it happens

Trigger: Management URL unreachable or invalid at dial time; TLS handshake failure against management (untrusted CA, wrong host); private key unreadable or corrupt.

Common situations: Typo in the management host; self-hosted management with a certificate the device does not trust; first run on a device with no network.

Related errors

• failed to check SSO support: %v
• login failed: %v
• failed to check login requirement: %v
• failed to create auth client: %v
• JWT already used

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/90ecfc7b183eb83a. Report an issue: GitHub.