getting pkce authorization flow info failed with error: %v

Error message

getting pkce authorization flow info failed with error: %v

What it means

Returned by authenticateWithPKCEFlow when the getPKCEFlow management RPC fails after a successful connection (client/internal/auth/oauth.go:95-98). The RPC asks management for the PKCE/SSO provider configuration; errors include Unimplemented from older management servers that predate this endpoint, NotFound when no IdP is configured, or any transport/permission error. Unlike the device flow, this path has no gRPC code switch, so raw status text surfaces. NewOAuthFlow logs this at debug and falls back to the device code flow, so users see it mainly in debug logs; the surfaced error comes from the fallback (927-930).

Source

Thrown at client/internal/auth/oauth.go:97

	if err != nil {
		log.Debugf("failed to initialize pkce authentication with error: %v\n", err)
		log.Debug("falling back to device code flow")
		return authenticateWithDeviceCodeFlow(ctx, config, hint)
	}
	return pkceFlow, nil
}

// authenticateWithPKCEFlow initializes the Proof Key for Code Exchange flow auth flow
func authenticateWithPKCEFlow(ctx context.Context, config *profilemanager.Config, hint string) (OAuthFlow, error) {
	authClient, err := NewAuth(ctx, config.PrivateKey, config.ManagementURL, config)
	if err != nil {
		return nil, fmt.Errorf("failed to create auth client: %v", err)
	}
	defer authClient.Close()

	pkceFlowInfo, err := authClient.getPKCEFlow(authClient.client)
	if err != nil {
		return nil, fmt.Errorf("getting pkce authorization flow info failed with error: %v", err)
	}

	if hint != "" {
		pkceFlowInfo.SetLoginHint(hint)
	}

	return pkceFlowInfo, nil
}

// authenticateWithDeviceCodeFlow initializes the Device Code auth Flow
func authenticateWithDeviceCodeFlow(ctx context.Context, config *profilemanager.Config, hint string) (OAuthFlow, error) {
	authClient, err := NewAuth(ctx, config.PrivateKey, config.ManagementURL, config)
	if err != nil {
		return nil, fmt.Errorf("failed to create auth client: %v", err)
	}
	defer authClient.Close()

	deviceFlowInfo, err := authClient.getDeviceFlow(authClient.client)

View on GitHub (pinned to 93e97f4bf1)

Solutions

Run netbird up --log-level debug to confirm whether the subsequent device-code fallback also failed - the real user-facing error is 927-930
Update self-hosted management to a version matching the client so the PKCE endpoint exists
Ensure an IdP/SSO provider is configured for the account in management
Retry after management is healthy; transient gRPC errors resolve on a new flow

Defensive patterns

Strategy: fallback

Try / catch

// In callers of NewOAuthFlow: PKCE init errors are already handled by fallback to device flow.
flow, err := auth.NewOAuthFlow(ctx, cfg, isDesktop, forceDeviceFlow, hint)
if err != nil {
	if gstatus, ok := gstatus.FromError(errors.Unwrap(err)); ok && gstatus.Code() == codes.Unimplemented {
		// management too old for provider-config RPCs
	}
}

Prevention

Keep management and client versions roughly in sync so provider-config RPCs exist
Configure an IdP for the account before offering interactive SSO login
Use debug logging to distinguish a swallowed PKCE failure from a terminal device-flow failure

When it happens

Trigger: authClient.getPKCEFlow(authClient.client) returns an error: management version predating the login PKCE-provider RPC (codes.Unimplemented), account without a configured IdP (NotFound), expired login session token, or a transient gRPC failure.

Common situations: Client newer than a self-hosted management server (PKCE RPC not implemented yet); IdP removed from the account while the user attempts interactive login; management restarted mid-request.

Related errors

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/932be86e13210159. Report an issue: GitHub.