Error: Failed to install provider

Not specified by the original author.

Fix terraform "Error: Failed to install provider"

TL;DR: terraform init could not download or verify a provider plugin. Read the line under the error; it names the real cause (network timeout, checksum mismatch, no space left, missing platform package). Fix that cause, then re-run terraform init. Most cases are transient network failures or a stale .terraform.lock.hcl.

The error

Error: Failed to install provider

Error while installing hashicorp/aws v6.47.0: write
.terraform/providers/registry.terraform.io/hashicorp/aws/6.47.0/linux_amd64/terraform-provider-aws_v6.47.0_x5: no space left on
device

(Your sub-line will differ. Common ones: checksum mismatch against the lock file, TLS handshake timeout, registry unreachable.)

Steps

1. Read the sub-error. It is the actual diagnosis. Categorize it:

   • no space left on device: free disk space.
   • doesn't match any of the checksums previously recorded in the dependency lock file: lock file conflict.
   • TLS handshake timeout / connection refused / Could not retrieve the list of available versions: network or proxy.
   • does not have a package available for your current platform: wrong arch (e.g. 32-bit).

2. For lock-file checksum conflicts, regenerate the lock file:

   rm .terraform.lock.hcl
   terraform init

   Expected: providers install, and a fresh lock file is written. Commit it.

3. For network failures, check reachability and retry. Behind a corporate proxy, export the proxy vars first:

   curl -s https://registry.terraform.io/.well-known/terraform.json
   export HTTPS_PROXY=YOUR_PROXY_HOST
   export HTTP_PROXY=YOUR_PROXY_HOST
   terraform init

   Expected: the registry answers and the install proceeds.

4. For repeated flakiness (GitHub CDN TLS timeouts on community providers), retry once or twice; these are usually transient. Expected: a later init succeeds with no config change.

When this applies

• terraform init fails at the "Installing ..." step with any sub-error.
• You changed provider versions, platforms, or the lock file.

When it does NOT apply

• Init fails earlier at "Finding ... versions" with Failed to query available provider packages. That is version-constraint or registry-access, a different fix.
• The provider installs but plan fails with auth errors. That is provider configuration, not installation.

Tool and version compatibility

• Terraform CLI 0.13+ (provider source model) through 1.x.
• registry.terraform.io and community providers hosted on GitHub releases.

Why it happens

Init downloads each provider binary for your platform and verifies it against .terraform.lock.hcl checksums. Anything that breaks that chain (no disk, no network, a lock file written on another platform, a registry namespace that moved like zscaler.com/zpa to zscaler/zpa) fails the whole install.

Edge cases and pitfalls

• Deleting the lock file and re-running init on a different platform than your team (M1 Mac vs Linux CI) writes platform-specific hashes. Regenerate for all target platforms with terraform providers lock -platform=linux_amd64 -platform=darwin_arm64 and commit the result.
• Fully offline environments: download the provider zip, unpack it into the local plugin dir layout, and init works without the network.
• Do not hand-edit checksums in the lock file. Regenerate it.

A user reported terraform init failing with Error: Failed to install provider for the cloudstack provider, with a TLS handshake timeout reaching GitHub's CDN. The confirmed diagnosis was a network path problem between their machine and the CDN endpoint; the suggested fix was to retry from a different network or install the provider binary locally into the plugin directory, after which init succeeded. Source: HashiCorp Discuss thread, https://discuss.hashicorp.com/t/error-when-installing-terraform-cloudstack-provider-plugin/59691

Not specified by the original author.

TL;DR: tofu can't download the provider: the registry asked for auth credentials, or the connection failed. Read the tail of the message. requires authentication credentials on registry.opentofu.org has been a transient registry-side incident; TLS timeouts are your network. Retry first, then check proxy and mirrors.

Error: Failed to install provider

Error while installing hashicorp/random v3.7.2: host registry.opentofu.org
requires authentication credentials

Steps

1. Read the tail of the error (the part after the provider name and version). It distinguishes the causes:

   • requires authentication credentials / 403 Forbidden: registry-side or proxy issue.
   • TLS handshake timeout / could not connect: your network.
   • checksum mismatch: lock file problem, different fix.

   Expected: you can name the cause.

2. Retry once. Registry-side blips and rate limits are transient. Expected: the second tofu init succeeds.

3. If it persists, check the path to the registry: proxy env vars (HTTPS_PROXY), egress firewall rules, and whether curl -sI https://registry.opentofu.org answers from the same machine. Expected: you find the broken hop.

4. For air-gapped or flaky networks, install via a filesystem mirror: download the provider zip once, unpack it under the documented local mirror directory layout, and re-run init. Expected: init uses the local copy without touching the network.

When this applies

• tofu init fails on Error while installing [provider] v[version]: with a registry, auth, or network complaint.
• It worked before with no config change (points at transient/registry-side).

When it doesn't apply

• Error: Failed to query available provider packages fails earlier, at version LISTING; this error fails at DOWNLOAD.
• Checksum mismatches (doesn't match any of the checksums previously recorded) are a lock-file problem; fix with tofu providers lock.

Tool versions

All OpenTofu versions.

Why it happens

Installing is a plain HTTPS download from the registry (or a mirror). Anything that breaks HTTPS here, broken proxy, egress block, expired CA bundle, registry incident, surfaces as this error, after version resolution already succeeded.

Edge cases

• Corporate MITM proxies: the Go HTTP client needs the proxy CA in the system trust store, or every registry call fails TLS.
• Don't "fix" a 403 by adding registry credentials to your CLI config unless you actually use a private registry. The public registry needs no auth; a 403 there is an incident or a proxy mangling the request.
• CI runners with IPv6-only egress have hit discovery-document failures; forcing IPv4 or fixing egress is the fix, not the config.

Asked: how to fix Error: Failed to install provider. Verified answer: Fixes OpenTofu's 'Error: Failed to install provider' when the registry demands auth or the download fails. The fix steps above were cross-checked against the accepted community answer at https://github.com/opentofu/registry/issues/2614, which confirms the same resolution.

Not specified by the original author.

TL;DR: This error means the provider package is not installed. LangChain splits every provider into its own package, so installing langchain alone is never enough for OpenAI, Anthropic, or any other model or store. Confirm: pip show langchain-openai (or the provider you need). Install it: pip install -U langchain-openai.

The fix

1. pip install langchain gives you agents, messages, tools, chat models, embeddings. It deliberately does not pull in any provider SDK.
2. The same applies to vector stores: langchain-chroma, langchain-pinecone, langchain-qdrant, langchain-weaviate, langchain-mongodb, langchain-elasticsearch, langchain-redis are all separate installs.
3. A stale lockfile or a fresh virtualenv is the usual trigger: the code was written on a machine that had the provider package, the new environment does not.
4. Confirm: pip show langchain-openai (or the provider you need).
5. Install it: pip install -U langchain-openai.
6. If the project is uv-managed, use uv add langchain-openai instead of mixing pip and uv. Do not reinstall langchain itself; that changes nothing. The missing piece is always the provider package.

When to use this

• You are seeing this exact error message; match the block above, not just part of it.
• The failing call matches the scenario in the title: ModuleNotFoundError.
• You want the fastest verified fix before digging through logs.

When not to use this

• Your error text differs from the block above; close cousins often have different causes.
• The stack trace points at a different component than the one in the title.
• You already applied this fix and the error persists; look for a second cause instead of reapplying.

Compatibility

• Not pinned to a specific version; follows current ModuleNotFoundError behavior.

Error catalog entry grounded in the official install and providers docs, verified 2026-09-26. Install: https://docs.langchain.com/oss/python/langchain/install ; providers: https://docs.langchain.com/oss/python/integrations/providers/overview