<!--- Please read this! Before opening a new issue, make sure to search for keywords in the issues filtered by the "bug" label: - https://gitlab.com/gitlab-org/cli/-/issues/?label_name%5B%5D=type%3A%3Abug and verify the issue you're about to submit isn't a duplicate. ---> ### Checklist <!--Please test the latest versions, that will remove the possibility that you see a bug that is fixed in a newer version.--> - [x] I'm using the latest version of the extension (Run `glab --version`) - Extension version: _glab 1.67.0 (1e957280)_ - [x] Operating system and version: _MacOS Sequoia 15.6.1 (24G90)_ - [x] Gitlab.com or self-managed instance? _self-managed instance_ - [x] GitLab version (if self-managed) _17.11.4-ee_ - [x] I have performed `glab auth status` to check for authentication issues - [x] Run the command in debug mode (like `DEBUG=true glab mr list`) and attach any useful output ### Summary <!--Summarize the bug encountered concisely--> ### Environment <!--on POSIX system (Linux, MacOS), run bash -c 'printf -- "- OS: %s\n- SHELL: %s\n- TERM: %s\n- GLAB: %s" "$(uname -srm)" "$SHELL" "$TERM" "$(glab --version)"' and replace the following section with the result. If you use non-POSIX system, fill in the section manually: - OS: Your operating system including version and architecture (Windows 11 - AMD64, MacOS Sonoma - ARM64) - SHELL: Your shell (bash, fish, zsh, ...) - TERM: Your terminal emulator (Kitty, Xterm2..) - GLAB: result of running `glab --version` (glab version 1.32.0 (2023-08-18))--> - OS: Darwin 24.6.0 arm64 - SHELL: /bin/zsh - TERM: xterm-256color - GLAB: glab 1.67.0 (1e957280)% <!--Please include any other information that you believe might be relevant in debugging. For example, you may include a shell framework like oh-my-zsh or other customizations like editing the prompt (PS1, PS2, and others).--> Other: ### Steps to reproduce 1. Configure `.config/glab-cli/config.yml` for OIDC auth (OIDC token has `api` scope) 1. `unset GITLAB_ACCESS_TOKEN` to make sure glab doesn't try to use that instead 2. CD to local terraform\\opentofu project and run `glab opentofu init state-name` NOTE: If I export a personal access token with the `api` scope as `GITLAB_ACCESS_TOKEN` the `init` command works as expected. ### What is the current _bug_ behavior? The init attempt fails with: `Error refreshing state: HTTP remote state endpoint requires auth` ### What is the expected _correct_ behavior? Should properly use OIDC token to auth against remote state backend. (preferred, if possible) OR Should output error message about OIDC token not being supported for remote state auth and that a personal access token is required instead. (Only if OIDC token is truly not compatible with remote state.) ### Relevant logs and/or screenshots ``` DEBUG=true glab opentofu init staging [git remote -v] [git config --get-regexp ^remote\..*\.glab-resolved$] 2025/08/28 10:21:37 Could not parse telemetry config value - defaulting to 'true' Initializing the backend... Error refreshing state: HTTP remote state endpoint requires auth ERROR: exit status 1 ``` ### Possible fixes <!--If you can, link to the line of code that might be responsible for the problem-->