ory/hydra · error

unable to open file %q: %w

Error message

unable to open file %q: %w

What it means

clientFromFlags in cmd/cmd_helper_client.go wraps any os.Open failure with "unable to open file %q: %w". The Hydra CLI lets you supply an OAuth2 client JSON from a file via the --file flag; this error means the file path given could not be opened (missing, unreadable, wrong permissions, or a directory).

Source

Thrown at cmd/cmd_helper_client.go:25

	"encoding/json"
	"fmt"
	"os"
	"strings"

	"github.com/spf13/cobra"
	"github.com/spf13/pflag"

	hydra "github.com/ory/hydra-client-go/v2"
	"github.com/ory/x/flagx"
)

func clientFromFlags(cmd *cobra.Command) (hydra.OAuth2Client, error) {
	if filename := flagx.MustGetString(cmd, flagFile); filename != "" {
		src := cmd.InOrStdin()
		if filename != "-" {
			f, err := os.Open(filename) // #nosec G304
			if err != nil {
				return hydra.OAuth2Client{}, fmt.Errorf("unable to open file %q: %w", filename, err)
			}
			defer f.Close() //nolint:errcheck
			src = f
		}
		client := hydra.OAuth2Client{}
		if err := json.NewDecoder(src).Decode(&client); err != nil {
			return hydra.OAuth2Client{}, fmt.Errorf("unable to decode JSON: %w", err)
		}
		return client, nil
	}

	return hydra.OAuth2Client{
		AccessTokenStrategy:               new(flagx.MustGetString(cmd, flagClientAccessTokenStrategy)),
		AllowedCorsOrigins:                flagx.MustGetStringSlice(cmd, flagClientAllowedCORSOrigin),
		Audience:                          flagx.MustGetStringSlice(cmd, flagClientAudience),
		BackchannelLogoutSessionRequired:  new(flagx.MustGetBool(cmd, flagClientBackChannelLogoutSessionRequired)),
		BackchannelLogoutUri:              new(flagx.MustGetString(cmd, flagClientBackchannelLogoutCallback)),
		ClientName:                        new(flagx.MustGetString(cmd, flagClientName)),

View on GitHub (pinned to 4174065ffb)

Solutions

1. Check the file exists and is readable: ls -l <path>, fix path or permissions
2. Use an absolute path or cd into the directory first
3. Pass the client as inline flags instead of --file, or pipe JSON via --file -
4. Verify the path is a regular file, not a directory

Example fix

// before
hydra create client --file ./clint.json
// after
hydra create client --file ./client.json  # or absolute: /etc/hydra/client.json

p := flagx.MustGetString(cmd, flagFile)
if p != "-" && p != "" {
    if _, err := os.Stat(p); err != nil {
        return fmt.Errorf("cannot read %q: %w", p, err)
    }
}

if err != nil {
    var pe *fs.PathError
    if errors.As(err, &pe) {
        fmt.Fprintf(os.Stderr, "cannot open %s: %v\n", pe.Path, pe.Err)
    }
    os.Exit(1)
}

When it happens

Trigger: Running any hydra client command (create/update/etc.) with --file pointing to a path that does not exist, lacks read permission, or is a directory.

Common situations: Typos in the path, running the CLI from a different working directory than expected, file deleted between edits and run, using a relative path in a script/CI where cwd differs, or permissions issues after downloading a JSON export as another user.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

Related errors

• command expects one argument which is the path to the output
• file loader disabled
• A DSN is required as a positional argument when not passing
• Janitor requires at least one of --tokens, --requests or --g
• Values for --limit and --batch-size should both be greater t

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/32ece7789f937556. Report an issue: GitHub.