What causes "management client is not initialised" in netbirdio/netbird?

Only call ExtendAuthSession when the daemon status reports Connected (query Status/SubscribeStatus first).

management client is not initialised

Error message

management client is not initialised

What it means

Thrown by Engine.ExtendAuthSession (client/internal/engine_authsession.go:88) when the engine's management gRPC client (e.mgmClient) is nil. That client is only created when the engine starts and connects to the NetBird management service, so a nil value means the engine currently has no management connection and cannot forward the SSO session-extension request. The guard fires before any network call or system-info collection.

Source

Thrown at client/internal/engine_authsession.go:88

func (e *Engine) DismissSessionWarning() {
	if e.sessionWatcher == nil {
		return
	}
	e.sessionWatcher.Dismiss()
}

// ExtendAuthSession asks the management server to refresh the SSO session
// expiry deadline using the supplied JWT, then mirrors the new deadline into
// the daemon's state. The tunnel is untouched; no resync, no reconnect.
//
// Returns the new absolute UTC deadline (or zero time when the server
// reports the peer is not eligible for extension).
func (e *Engine) ExtendAuthSession(ctx context.Context, jwtToken string) (time.Time, error) {
	if jwtToken == "" {
		return time.Time{}, errors.New("jwt token is required")
	}
	if e.mgmClient == nil {
		return time.Time{}, errors.New("management client is not initialised")
	}

	info, err := system.GetInfoWithChecks(ctx, e.checks)
	if err != nil {
		log.Warnf("failed to collect system info for session extend: %v", err)
		info = system.GetInfo(ctx)
	}

	resp, err := e.mgmClient.ExtendAuthSession(info, jwtToken)
	if err != nil {
		return time.Time{}, fmt.Errorf("extend auth session on management: %w", err)
	}

	e.ApplySessionDeadline(resp.GetSessionExpiresAt())

	if resp.GetSessionExpiresAt().IsValid() {
		return resp.GetSessionExpiresAt().AsTime().UTC(), nil
	}

View on GitHub (pinned to 93e97f4bf1)

Solutions

Only call ExtendAuthSession when the daemon status reports Connected (query Status/SubscribeStatus first).
If hit during startup, wait for the connection to be established and retry the extend call.
If hit on a long-running daemon, the session/engine was torn down: re-authenticate (login + up) to rebuild the management client.
Check daemon logs for a prior management disconnect that nilled the client.

Example fix

// before
newDeadline, err := engine.ExtendAuthSession(ctx, jwt)
if err != nil {
    // fails with "management client is not initialised" during startup
}

// after: gate on connection state first
status, _ := daemonClient.Status(ctx)
if status.GetStatus() != daemonpb.StatusEnum_CONNECTED {
    // wait or prompt the user to connect before extending
    return fmt.Errorf("connect the daemon before extending the session")
}
newDeadline, err := engine.ExtendAuthSession(ctx, jwt)

Defensive patterns

Strategy: validation

Validate before calling

// Before calling ExtendAuthSession, confirm the engine actually holds a
// management connection.
status, err := daemonClient.Status(ctx)
if err != nil {
    return err
}
if status.GetStatus() != daemonpb.StatusEnum_CONNECTED {
    return fmt.Errorf("daemon not connected (status %s); connect before extending session", status.GetStatus())
}

Try / catch

// In-process Go callers:
if _, err := engine.ExtendAuthSession(ctx, jwt); err != nil {
    if strings.Contains(err.Error(), "management client is not initialised") {
        // engine not connected yet: wait for Connected status and retry once
    }
    return err
}

Prevention

Gate every session-management RPC on daemon status Connected.
Never cache an Engine reference across login/logout boundaries; re-acquire it after state changes.
In UIs, disable the 'extend session' action while status is not Connected.

When it happens

Trigger: Calling ExtendAuthSession (daemon RPC / UI 'refresh session' action) before the engine finished connecting to management, after the engine was stopped (netbird down / logout nils the client), or while the daemon is still in the NeedsLogin or Connecting state.

Common situations: Desktop UI or CLI issues a session-extend request immediately after daemon startup, before 'up' completes; a retry races the login flow; the session-extension path is invoked on an engine instance that was already torn down during logout or MDM-triggered restart.

Related errors

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/d1464d51a96f5b0f. Report an issue: GitHub.