netbirdio/netbird · error

login backoff cycle failed: %v

Error message

login backoff cycle failed: %v

What it means

The Login RPC is executed inside a backoff retry loop. Permanent gRPC codes (InvalidArgument, PermissionDenied, NotFound, Unimplemented) break out immediately as loginErr; every other error (typically Unavailable, DeadlineExceeded) is retried with backoff. This message appears only when the loop itself ended with an error that was not one of those permanent codes — i.e. retries were exhausted or a non-permanent failure kept recurring.

Source

Thrown at client/cmd/up.go:378

	}

	var loginErr error
	var loginResp *proto.LoginResponse

	err = WithBackOff(func() error {
		var backOffErr error
		loginResp, backOffErr = client.Login(ctx, loginRequest)
		if s, ok := gstatus.FromError(backOffErr); ok && (s.Code() == codes.InvalidArgument ||
			s.Code() == codes.PermissionDenied ||
			s.Code() == codes.NotFound ||
			s.Code() == codes.Unimplemented) {
			loginErr = backOffErr
			return nil
		}
		return backOffErr
	})
	if err != nil {
		return fmt.Errorf("login backoff cycle failed: %v", err)
	}

	if loginErr != nil {
		return daemonCallError("login failed", loginErr)
	}

	if loginResp.NeedsSSOLogin {
		if err := handleSSOLogin(ctx, cmd, loginResp, client, pm); err != nil {
			return fmt.Errorf("sso login failed: %v", err)
		}
	}

	if _, err := client.Up(ctx, &proto.UpRequest{
		ProfileName: &profileID,
		Username:    &username,
	}); err != nil {
		return daemonCallError("call service up method", err)
	}

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Check that the daemon can reach management: verify the management URL, DNS resolution, and TLS cert validity
2. Look at the wrapped error for the gRPC code — Unavailable/DeadlineExceeded point to connectivity, not credentials
3. Retry once connectivity is restored; if the code is InvalidArgument or PermissionDenied it will instead surface as 'login failed', a credential problem

// preflight management reachability to fail fast instead of burning backoff
if _, err := tls.DialWithDialer(&net.Dialer{Timeout: 5 * time.Second}, "tcp", mgmtHostPort, tlsConfig); err != nil {
	return fmt.Errorf("management unreachable, fix before up: %w", err)
}

if s, ok := status.FromError(err); ok {
	switch s.Code() {
	case codes.InvalidArgument, codes.PermissionDenied, codes.NotFound, codes.Unimplemented:
		// permanent: fix credentials/config, do not retry
	default:
		// transient: safe to retry with your own backoff
	}
}

When it happens

Trigger: Management service unreachable for the whole backoff window (wrong host/DNS, firewall, TLS failure); daemon lost connection to the CLI mid-login; context canceled (Ctrl+C) during retrying; management returning codes outside the permanent list.

Common situations: Typo in --management-url, management server down during maintenance, self-hosted management with an expired cert, captive networks blocking gRPC, or the user aborting while it retries.

Related errors

• no connection to management
• engine not started
• waiting sso login failed with: %v
• unable to get daemon status: %v
• sso login failed: %v

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/2f2cd4dd72537a06. Report an issue: GitHub.