> ## Documentation Index
> Fetch the complete documentation index at: https://braintrust.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# CLI auth fails for self-hosted deployments with TLS errors

export const plans_0 = "Enterprise"

export const deployments_0 = "Self-hosted"

export const data_plane_version_0 = undefined

export const use_case_0 = "Use case - Configuring the Braintrust CLI for self-hosted deployments when OAuth and API key auth fail"

<Note>
  **Applies to:**

  * Plan - {plans_0}
  * Deployment - {deployments_0}
  * {data_plane_version_0}
  * {use_case_0}
</Note>

## Summary

**Issue:** The Braintrust CLI fails to authenticate via OAuth or API key, with errors like `failed to call oauth token endpoint` or `invalid peer certificate: UnknownIssuer` when running `bt auth login` or `bt setup`.

**Cause:** The CLI defaults to Braintrust hosted endpoints; corporate TLS inspection can also intercept traffic and re-sign certificates with an untrusted CA.

**Resolution:** Point the CLI at your self-hosted data plane and, if your network intercepts TLS traffic, configure `BRAINTRUST_CA_CERT` to trust your CA bundle.

## Resolution steps

### If you see `failed to call oauth token endpoint`:

#### Step 1: Set your API URL and if necessary your APP URL

```bash theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
export BRAINTRUST_API_URL="https://<your-api-url>"
export BRAINTRUST_APP_URL="https://<your-app-url>"
```

#### Step 2: Authenticate

OAuth:

```bash theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
bt auth login --no-browser
```

API key:

```bash theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
export BRAINTRUST_API_KEY="<your_key>"
```

#### Step 3: Verify connectivity

```bash theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
bt auth profiles
bt status --verbose
```

### If you see `invalid peer certificate: UnknownIssuer`:

Your network is intercepting and re-signing TLS traffic. Configure your CA bundle.

#### Step 1: Set the CA cert path

```bash theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
export BRAINTRUST_CA_CERT="/path/to/ca_bundle.pem"
```

#### Step 2: Run `bt setup` with the CA cert flag

```bash theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
bt setup --api-key "$BRAINTRUST_API_KEY" --agent <your-agent> --ca-cert "$BRAINTRUST_CA_CERT"
```

#### Step 3: Verify

```bash theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
bt status --verbose
```