Skip to main content
Applies to:
  • Plan -
  • Deployment -

​
Summary

Issue: bt fails to authenticate with errors like failed to call oauth token endpoint or invalid peer certificate: UnknownIssuer. Cause: The CLI defaults to Braintrust hosted endpoints; corporate TLS inspection can also intercept traffic and re-sign certificates with an untrusted CA. Resolution: Point the CLI at your self-hosted data plane and, if your network intercepts TLS traffic, configure BRAINTRUST_CA_CERT to trust your CA bundle.

​
Resolution steps

​
If you see failed to call oauth token endpoint

​
Step 1: Set your API URL and, if necessary, your app URL

​
Step 2: Authenticate

Choose one authentication method. For OAuth, run:
Use --no-browser only if you’re in an SSH, VM, or other headless environment where bt cannot open a browser automatically. For API key auth, set:

​
Step 3: Retry the command that failed

After setting the endpoint and authenticating, retry the bt command that failed. In bt v0.16.0 and later, you can also run bt status --all to check saved login profiles.

​
If you see invalid peer certificate: UnknownIssuer

Your network is intercepting and re-signing TLS traffic. Configure your CA bundle.

​
Step 1: Set the CA cert path

The path must point to a PEM bundle that includes the corporate or private CA used to sign the certificate.

​
Step 2: Retry the command that failed

After setting BRAINTRUST_CA_CERT, retry the bt command that failed. In bt v0.16.0 and later, you can also run bt status --all to check saved login profiles.