netbirdio/netbird · error

foreground login failed: %v

Error message

foreground login failed: %v

What it means

Thrown by runInForegroundMode (client/cmd/up.go:254), wrapping foregroundLogin. That function performs the whole interactive/control-plane login the daemon would otherwise do: creating the auth client from the config's private key and management URL, calling IsLoginRequired, running the browser-based device-authorization SSO flow when no setup key is given, and finally authClient.Login with the setup key or JWT. Any of those steps failing lands here.

Source

Thrown at client/cmd/up.go:254

	// DNS config (a stale resolv.conf takeover can make the management
	// hostname unresolvable), firewall rules, ssh config and legacy routing.
	// Route cleanup itself happens at engine start; nbnet.Init() below lets
	// the management dial bypass a leftover fwmark rule until then.
	// Foreground mode is particularly exposed in containers: a crashed
	// container restarts inside the same (pod) network namespace, so stale
	// state survives while the process does not.
	if err := server.RestoreResidualState(ctx, profilemanager.NewServiceManager(configPath).GetStatePath()); err != nil {
		log.Warnf("failed to restore residual state: %v", err)
	}

	// Enable advanced routing (as the daemon does on startup) so the
	// management dial bypasses a leftover fwmark rule instead of being
	// shunted into a stale routing table.
	nbnet.Init()

	err = foregroundLogin(ctx, cmd, config, providedSetupKey, activeProf.ID)
	if err != nil {
		return fmt.Errorf("foreground login failed: %v", err)
	}

	var cancel context.CancelFunc
	ctx, cancel = context.WithCancel(ctx)
	SetupCloseHandler(ctx, cancel)

	r := peer.NewRecorder(config.ManagementURL.String())
	r.GetFullStatus()

	connectClient := internal.NewConnectClient(ctx, config, r)
	SetupDebugHandler(ctx, config, r, connectClient, "")

	return connectClient.Run(nil, util.FindFirstLogPath(logFiles))
}

func runInDaemonMode(ctx context.Context, cmd *cobra.Command, pm *profilemanager.ProfileManager, activeProf *profilemanager.Profile, profileSwitched bool) error {
	// Check if deprecated config flag is set and show warning
	if cmd.Flag("config").Changed && configPath != "" {

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Verify management reachability from the host (curl -v https://<management-url>) and fix DNS/firewall/TLS trust
2. Use a fresh setup key: 'netbird up --foreground-mode --setup-key <key>' (valid, non-expired, from the admin UI)
3. For SSO, complete the opened verification URL before the flow expires, or use --setup-key in headless environments
4. Check host clock (NTP) - skew breaks certificate and token validation

if _, err := net.DialTimeout("tcp", urlHost(config.ManagementURL), 3*time.Second); err != nil {
    log.Warnf("management unreachable before login attempt: %v", err)
}

if err := foregroundLogin(ctx, cmd, config, providedSetupKey, activeProf.ID); err != nil {
    if strings.Contains(err.Error(), "setup key") || strings.Contains(err.Error(), "login failed") {
        // credentials problem: do not retry, ask for a fresh setup key
        return fmt.Errorf("foreground login failed (credential issue): %w", err)
    }
    // transport/SSO issues are often transient: safe to retry after fixing reachability
    return fmt.Errorf("foreground login failed: %w", err)
}

When it happens

Trigger: 'netbird up --foreground-mode' when management is unreachable (IsLoginRequired dial fails), the browser SSO flow times out or is canceled, an expired/invalid --setup-key is used, the private key in the config cannot be loaded, or TLS verification against management fails.

Common situations: Containers without a browser where the SSO flow cannot complete; expired setup keys; management behind a proxy with an untrusted certificate; clock skew breaking TLS and JWT validation.

Related errors

• get active profile file path: %v
• setup config: %v
• get config file: %v
• get setup key: %v
• management client is not initialised

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/4a9530fb11dac2a2. Report an issue: GitHub.