ory/hydra · error

Failed to accept user code request: %s

Error message

Failed to accept user code request: %s

What it means

Returned when the HTTP client fails to execute the PUT request to the admin device-accept endpoint (hc.Do(req) errors). This is a transport-level failure: the admin server was unreachable, TLS failed, DNS failed, the connection was reset, or the request context was canceled. The handler converts it into a 500 with the underlying error text.

Source

Thrown at cmd/cmd_perform_device_flow.go:218

	if err != nil {
		http.Error(w, fmt.Sprintf("Failed to encode request body: %s", err), http.StatusInternalServerError)
		return
	}
	req, err := http.NewRequestWithContext(r.Context(), http.MethodPut, acceptURL, bytes.NewReader(body))
	if err != nil {
		http.Error(w, fmt.Sprintf("Failed to create request: %s", err), http.StatusInternalServerError)
		return
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Accept", "application/json")

	hc := cfg.HTTPClient
	if hc == nil {
		hc = http.DefaultClient
	}
	res, err := hc.Do(req)
	if err != nil {
		http.Error(w, fmt.Sprintf("Failed to accept user code request: %s", err), http.StatusInternalServerError)
		return
	}
	defer res.Body.Close() //nolint:errcheck
	raw, err := io.ReadAll(io.LimitReader(res.Body, 1<<20))
	if err != nil {
		http.Error(w, fmt.Sprintf("Failed to read response: %s", err), http.StatusInternalServerError)
		return
	}
	if res.StatusCode != http.StatusOK {
		http.Error(w, fmt.Sprintf("Failed to accept user code request: %s", raw), http.StatusInternalServerError)
		return
	}
	var accepted struct {
		RedirectTo string `json:"redirect_to"`
	}
	if err := json.Unmarshal(raw, &accepted); err != nil || accepted.RedirectTo == "" {
		http.Error(w, "Malformed response from the accept endpoint", http.StatusInternalServerError)
		return

View on GitHub (pinned to 4174065ffb)

Solutions

  1. Verify cfg.Servers[0].URL points at the reachable Hydra ADMIN endpoint and the admin port is published/reachable from where the CLI runs.
  2. Test connectivity directly: curl -X PUT '<acceptURL>' -d '{"user_code":"..."}' to reproduce and see the transport error.
  3. If using self-signed TLS, fix the trust chain (install CA or configure the HTTPClient's TLS config) rather than disabling verification in production.
  4. Retry transient network failures with backoff; surface context-canceled distinctly so users know the browser request was aborted.

Example fix

// before
res, err := hc.Do(req)
if err != nil {
	http.Error(w, fmt.Sprintf("Failed to accept user code request: %s", err), http.StatusInternalServerError)
	return
}
// after
res, err := hc.Do(req)
if err != nil {
	if errors.Is(err, context.Canceled) {
		http.Error(w, "Request canceled", http.StatusRequestTimeout)
		return
	}
	logger.Errorf("device accept request failed: %v", err)
	http.Error(w, "Admin endpoint unreachable", http.StatusBadGateway)
	return
}
Defensive patterns

Strategy: retry

Validate before calling

conn, err := net.DialTimeout("tcp", hostPortFromURL(cfg.Servers[0].URL), 3*time.Second)
if err != nil {
	return fmt.Errorf("hydra admin unreachable at %s: %w", cfg.Servers[0].URL, err)
}
conn.Close()

Type guard

func adminReachable(serverURL string, client *http.Client) bool {
	resp, err := client.Get(serverURL + "/admin/health/ready")
	if err != nil { return false }
	resp.Body.Close()
	return resp.StatusCode < 500
}

Try / catch

var res *http.Response
err := retry.Do(3, time.Second, func() error {
	var e error
	res, e = hc.Do(req.Clone(ctx))
	return e
})
if err != nil {
	if errors.Is(err, context.Canceled) { return err } // do not retry user aborts
	http.Error(w, "admin endpoint unreachable", http.StatusBadGateway)
	return
}

Prevention

When it happens

Trigger: hc.Do(req) at cmd/cmd_perform_device_flow.go:218 returns a non-nil error while accepting the device challenge — connection refused (admin API not running on cfg.Servers[0].URL), DNS resolution failure, TLS certificate errors, proxy issues, or r.Context() canceled because the browser user abandoned the POST.

Common situations: Hydra admin port not exposed or wrong port in config; running the CLI against https with a self-signed cert; firewall/DNS issues; docker network misconfiguration where the admin URL points at localhost from another container; user closed the tab mid-request (context canceled).

Understand the failure class

Background: ECONNREFUSED and "connection refused" / "could not connect to server" errors: what they mean and how to fix them — this error's family across 44 libraries.

Related errors

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/6ce49b675ef4f480. Report an issue: GitHub.