> ## Documentation Index
> Fetch the complete documentation index at: https://docs.braintrust.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# CLI auth fails for self-hosted deployments with TLS errors

> [!NOTE]
>
> **Applies to:**
>
> * Plan - Enterprise
> * Deployment - Self-hosted
> *
> * Use case - Configuring the Braintrust CLI for self-hosted deployments when OAuth and API key auth fail

## Summary

**Issue:** `bt` fails to authenticate with errors like `failed to call oauth token endpoint` or `invalid peer certificate: UnknownIssuer`.

**Cause:** The CLI defaults to Braintrust hosted endpoints; corporate TLS inspection can also intercept traffic and re-sign certificates with an untrusted CA.

**Resolution:** Point the CLI at your self-hosted data plane and, if your network intercepts TLS traffic, configure `BRAINTRUST_CA_CERT` to trust your CA bundle.

## Resolution steps

### If you see `failed to call oauth token endpoint`

#### Step 1: Set your API URL and, if necessary, your app URL

```bash theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
export BRAINTRUST_API_URL="https://<your-api-url>"
export BRAINTRUST_APP_URL="https://<your-app-url>"
```

#### Step 2: Authenticate

Choose one authentication method.

For OAuth, run:

```bash theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
bt login --oauth
```

Use `--no-browser` only if you're in an SSH, VM, or other headless environment where `bt` cannot open a browser automatically.

For API key auth, set:

```bash theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
export BRAINTRUST_API_KEY="<your_key>"
```

#### Step 3: Retry the command that failed

After setting the endpoint and authenticating, retry the `bt` command that failed.

In `bt` v0.16.0 and later, you can also run `bt status --all` to check saved login profiles.

### If you see `invalid peer certificate: UnknownIssuer`

Your network is intercepting and re-signing TLS traffic. Configure your CA bundle.

#### Step 1: Set the CA cert path

```bash theme={"theme":{"light":"github-light","dark":"github-dark-dimmed"}}
export BRAINTRUST_CA_CERT="/path/to/ca_bundle.pem"
```

The path must point to a PEM bundle that includes the corporate or private CA used to sign the certificate.

#### Step 2: Retry the command that failed

After setting `BRAINTRUST_CA_CERT`, retry the `bt` command that failed.

In `bt` v0.16.0 and later, you can also run `bt status --all` to check saved login profiles.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.