[ENG-4117] fix: adds better auth logs

packages/api/errors.go

@@ -3,6 +3,7 @@ package api
 import (
 	"encoding/json"
 	"fmt"
+	"net/url"
 
 	"github.com/go-resty/resty/v2"
 	"github.com/infisical/go-sdk/packages/util"
@@ -105,9 +106,30 @@ func NewAPIErrorWithResponse(operation string, res *resty.Response, additionalCo
 		apiError.Details = details
 	}
 
+	if res.StatusCode() == 403 || res.StatusCode() == 401 {
+		if apiError.AdditionalContext == "" {
+			domainHint := extractDomainHint(res.Request.URL)
+			if domainHint != "" {
+				apiError.AdditionalContext = fmt.Sprintf("This error often indicates you're using the wrong Infisical instance. Current request is to: %s\n\nTo fix this:\n• Verify you're using the correct domain with --domain flag or INFISICAL_API_URL environment variable\n• For EU region: use --domain https://eu.infisical.com\n• For self-hosted instances: use --domain https://your-instance.com", domainHint)
+			}
+		}
+	}
+
 	return apiError
 }
 
+func extractDomainHint(urlStr string) string {
+	if urlStr == "" {
+		return ""
+	}
+
+	if parsedURL, err := url.Parse(urlStr); err == nil && parsedURL.Host != "" {
+		return parsedURL.Scheme + "://" + parsedURL.Host
+	}
+
+	return ""
+}
+
 type errorResponse struct {
 	Message string `json:"message"`
 	Details any    `json:"details"`

packages/cmd/login.go

@@ -272,11 +272,15 @@ var loginCmd = &cobra.Command{
 			credential, err := authStrategies[strategy]()
 
 			if err != nil {
-				euErrorMessage := ""
-				if strings.HasPrefix(config.INFISICAL_URL, util.INFISICAL_DEFAULT_US_URL) {
-					euErrorMessage = fmt.Sprintf("\nIf you are using the Infisical Cloud Europe Region, please switch to it by using the \"--domain %s\" flag.", util.INFISICAL_DEFAULT_EU_URL)
+				domainHint := ""
+				currentDomain := strings.TrimSuffix(config.INFISICAL_URL, "/api")
+				errMsg := err.Error()
+
+				if strings.Contains(errMsg, "status-code=401") || strings.Contains(errMsg, "status-code=403") {
+					domainHint = fmt.Sprintf("\n\nThis error often indicates you're using the wrong Infisical instance. Current request is to: %s\n\nTo fix this:\n• Verify you're using the correct domain with --domain flag or INFISICAL_API_URL environment variable\n• For EU region: use --domain https://eu.infisical.com\n• For self-hosted instances: use --domain https://your-instance.com", currentDomain)
 				}
-				util.HandleError(fmt.Errorf("unable to authenticate with %s [err=%v].%s", formatAuthMethod(loginMethod), err, euErrorMessage))
+
+				util.HandleError(fmt.Errorf("unable to authenticate with %s [err=%v].%s", formatAuthMethod(loginMethod), err, domainHint))
 			}
 
 			if plainOutput {

packages/cmd/root.go

@@ -40,7 +40,7 @@ func init() {
 	cobra.OnInitialize(initLog)
 	rootCmd.PersistentFlags().StringP("log-level", "l", "", "log level (trace, debug, info, warn, error, fatal)")
 	rootCmd.PersistentFlags().Bool("telemetry", true, "Infisical collects non-sensitive telemetry data to enhance features and improve user experience. Participation is voluntary")
-	rootCmd.PersistentFlags().StringVar(&config.INFISICAL_URL, "domain", fmt.Sprintf("%s/api", util.INFISICAL_DEFAULT_US_URL), "Point the CLI to your own backend [can also set via environment variable name: INFISICAL_API_URL]")
+	rootCmd.PersistentFlags().StringVar(&config.INFISICAL_URL, "domain", fmt.Sprintf("%s/api", util.INFISICAL_DEFAULT_US_URL), "Point the CLI to your Infisical instance (e.g., https://eu.infisical.com for EU region, or https://your-instance.com for self-hosted). Can also set via INFISICAL_API_URL environment variable. Required for non-US users.")
 	rootCmd.PersistentFlags().Bool("silent", false, "Disable output of tip/info messages. Useful when running in scripts or CI/CD pipelines.")
 	rootCmd.PersistentPreRun = func(cmd *cobra.Command, args []string) {
 		silent, err := cmd.Flags().GetBool("silent")
@@ -71,7 +71,7 @@ func init() {
 	// this is used to allow overrides of the default value
 	if !rootCmd.Flag("domain").Changed {
 		if envInfisicalBackendUrl, ok := os.LookupEnv("INFISICAL_API_URL"); ok {
-			config.INFISICAL_URL = envInfisicalBackendUrl
+			config.INFISICAL_URL = util.AppendAPIEndpoint(envInfisicalBackendUrl)
 		}
 	}
 

packages/util/log.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"net/url"
 	"os"
 	"strings"
 
@@ -95,11 +96,20 @@ func printPrettyAPIError(apiErr api.APIError) {
 		Bold(true).
 		Foreground(lipgloss.Color(statusColor))
 
+	domain := extractDomainFromURL(apiErr.URL)
+
 	// Request details
 	content.WriteString(labelStyle.Render("Request: "))
 	content.WriteString(valueStyle.Render(fmt.Sprintf("%s %s", apiErr.Method, apiErr.URL)))
 	content.WriteString("\n")
 
+	// Show which instance is being used
+	if domain != "" {
+		content.WriteString(labelStyle.Render("Instance: "))
+		content.WriteString(valueStyle.Render(domain))
+		content.WriteString("\n")
+	}
+
 	// Request ID if available
 	if apiErr.ReqId != "" {
 		content.WriteString(labelStyle.Render("Request ID: "))
@@ -211,3 +221,15 @@ func getStatusCodeColor(statusCode int) string {
 		return "255" // White for unknown
 	}
 }
+
+func extractDomainFromURL(urlStr string) string {
+	if urlStr == "" {
+		return ""
+	}
+
+	if parsedURL, err := url.Parse(urlStr); err == nil && parsedURL.Host != "" {
+		return parsedURL.Scheme + "://" + parsedURL.Host
+	}
+
+	return ""
+}

test/.snapshots/test-TestUniversalAuth_SecretsGetWrongEnvironment

@@ -1,4 +1,5 @@
 Request: GET https://app.infisical.com/api/v3/secrets/raw?environment=invalid-env&expandSecretReferences=true&include_imports=true&recursive=true&secretPath=%2F&workspaceId=bef697d4-849b-4a75-b284-0922f87f8ba2
+Instance: https://app.infisical.com
 Request ID: <unknown-value>
 Response Code: 404 Not Found
 Message: Environment with slug 'invalid-env' in project with ID bef697d4-849b-4a75-b284-0922f87f8ba2 not found