CLI auth fails for self-hosted deployments with TLS errors

Applies to:

Plan -
Deployment -

Summary

Issue: The Braintrust CLI fails to authenticate via OAuth or API key, with errors like failed to call oauth token endpoint or invalid peer certificate: UnknownIssuer when running bt auth login or bt setup. Cause: The CLI defaults to Braintrust hosted endpoints; corporate TLS inspection can also intercept traffic and re-sign certificates with an untrusted CA. Resolution: Point the CLI at your self-hosted data plane and, if your network intercepts TLS traffic, configure BRAINTRUST_CA_CERT to trust your CA bundle.

Resolution steps

If you see `failed to call oauth token endpoint`:

Step 1: Set your API URL and if necessary your APP URL

export BRAINTRUST_API_URL="https://<your-api-url>"
export BRAINTRUST_APP_URL="https://<your-app-url>"

Step 2: Authenticate

OAuth:

bt auth login --no-browser

API key:

export BRAINTRUST_API_KEY="<your_key>"

Step 3: Verify connectivity

bt auth profiles
bt status --verbose

If you see `invalid peer certificate: UnknownIssuer`:

Your network is intercepting and re-signing TLS traffic. Configure your CA bundle.

Step 1: Set the CA cert path

export BRAINTRUST_CA_CERT="/path/to/ca_bundle.pem"

Step 2: Run `bt setup` with the CA cert flag

bt setup --api-key "$BRAINTRUST_API_KEY" --agent <your-agent> --ca-cert "$BRAINTRUST_CA_CERT"

Step 3: Verify

bt status --verbose

​Summary

​Resolution steps

​If you see failed to call oauth token endpoint:

​Step 1: Set your API URL and if necessary your APP URL

​Step 2: Authenticate

​Step 3: Verify connectivity

​If you see invalid peer certificate: UnknownIssuer:

​Step 1: Set the CA cert path

​Step 2: Run bt setup with the CA cert flag

​Step 3: Verify

Summary

Resolution steps

If you see `failed to call oauth token endpoint`:

Step 1: Set your API URL and if necessary your APP URL

Step 2: Authenticate

Step 3: Verify connectivity

If you see `invalid peer certificate: UnknownIssuer`:

Step 1: Set the CA cert path

Step 2: Run `bt setup` with the CA cert flag

Step 3: Verify