windmill-labs/windmill · error

Unauthorized access to private hub: ${hubBaseUrl}

Error message

Unauthorized access to private hub: ${hubBaseUrl}

What it means

Auth guard when pulling resource types from a hub: the POST to {hubBaseUrl}/resource_types/list returned HTTP 401. The code treats 401 as unambiguous — this only happens on private hubs — so the request reached the hub but its authentication rejected the request: missing/invalid API secret (X-api-secret header) for a private hub, or an expired/incorrect credential. The input at fault is the hub secret / credentials configured for that hub base URL.

Source

Thrown at cli/src/commands/hub/hub.ts:73

    log.info("Fetching resource types from private hub: " + hubBaseUrl);
    if (hubSecret) {
      log.info("Using hub API secret");
      headers["X-api-secret"] = hubSecret;
    }
  }

  if (uid) {
    headers["X-uid"] = uid;
  }

  let res1 = await fetch(hubBaseUrl + "/resource_types/list", {
    headers,
  });

  if (!res1.ok) {
    if (res1.status === 401) {
      // 401 can only happen on a private hub
      throw new Error("Unauthorized access to private hub: " + hubBaseUrl);
    } else {
      throw new Error(
        "Couldn't fetch resource types from hub " +
          hubBaseUrl +
          ": " +
          (await res1.text())
      );
    }
  }

  let list = (await res1.json()) as HubResourceType[];

  if (list && list.length === 0 && hubBaseUrl !== DEFAULT_HUB_BASE_URL) {
    log.info(
      "No resource types found in private hub, fetching from public hub"
    );
    delete headers["X-api-secret"];
    const res2 = await fetch(DEFAULT_HUB_BASE_URL + "/resource_types/list", {

View on GitHub (pinned to e474e8803c)

Solutions

1. Verify the hub API secret passed via hubSecret (X-api-secret header) is current for that private hub
2. Confirm the hub base URL targets the right hub instance and the token belongs to an account with access
3. If the secret rotated, obtain a new one from the hub operator and re-run with the updated credential

When it happens

Trigger: Thrown at cli/src/commands/hub/hub.ts:73 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/9365ca14b20158a6. Report an issue: GitHub.