netbirdio/netbird · error

getting a request OAuth flow info failed: %v

Error message

getting a request OAuth flow info failed: %v

What it means

oAuthFlow.RequestAuthInfo failed: the HTTP request to management's OAuth device-authorization endpoint (RFC 8628 device grant, e.g. POST /api/oauth/device-authorize) returned a transport error or a non-success status. Management only serves this endpoint when an IdP/OIDC provider is configured; a management without SSO, an unreachable management, or an IdP-side failure all surface here.

Source

Thrown at client/cmd/login.go:418

func foregroundGetTokenInfo(ctx context.Context, cmd *cobra.Command, config *profilemanager.Config, profileID profilemanager.ID) (*auth.TokenInfo, error) {
	hint := ""
	pm := profilemanager.NewProfileManager()
	profileState, err := pm.GetProfileState(profileID)
	if err != nil {
		log.Debugf("failed to get profile state for login hint: %v", err)
	} else if profileState.Email != "" {
		hint = profileState.Email
	}

	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, util.HasGraphicalSession(), false, hint)
	if err != nil {
		return nil, err
	}

	flowInfo, err := oAuthFlow.RequestAuthInfo(context.TODO())
	if err != nil {
		return nil, fmt.Errorf("getting a request OAuth flow info failed: %v", err)
	}

	openURL(cmd, flowInfo.VerificationURIComplete, flowInfo.UserCode, noBrowser, showQR)

	tokenInfo, err := oAuthFlow.WaitToken(context.TODO(), flowInfo)
	if err != nil {
		return nil, fmt.Errorf("waiting for browser login failed: %v", err)
	}

	return &tokenInfo, nil
}

func openURL(cmd *cobra.Command, verificationURIComplete, userCode string, noBrowser, showQR bool) {
	var codeMsg string
	if userCode != "" && !strings.Contains(verificationURIComplete, userCode) {
		codeMsg = fmt.Sprintf("and enter the code %s to authenticate.", userCode)
	}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Verify management is reachable and healthy (curl the base URL)
2. Confirm SSO/IdP is configured on the management instance and test it from the dashboard
3. If SSO is not intended, skip interactive login and use a setup key instead
4. Check management logs for the failing device-authorize request and any IdP error it records

// Verify management reachability and SSO capability before starting the flow
resp, err := http.Get(config.ManagementURL + "/api/peers")
if err != nil || resp.StatusCode >= 500 {
    return fmt.Errorf("management unhealthy: %v", err)
}
if !managementHasIdP {
    return fmt.Errorf("SSO not configured on management; use a setup key")
}

flowInfo, err := oAuthFlow.RequestAuthInfo(context.Background())
if err != nil {
    return fmt.Errorf("getting a request OAuth flow info failed: %w", err)
}

When it happens

Trigger: No IdP configured on management (endpoint rejects or 404s); management unreachable (network/DNS/TLS); IdP down or its client ID/issuer misconfigured in management settings; HTTP proxy interfering with the POST; non-200 response from the authorize endpoint.

Common situations: Self-hosted management deployed without completing the OIDC integration steps, then a client tries interactive login instead of a setup key; IdP maintenance windows; Management URL behind a load balancer whose cert does not match; Corporate proxies stripping or buffering the authorization request

Related errors

• management client is not initialised
• private services cannot enable bearer auth (SSO): NetBird-on
• service domain is required
• interactive sso login failed: %v
• waiting for browser login failed: %v

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/67bef6920f5bfd26. Report an issue: GitHub.