diff --git a/matchbox/client/client.go b/matchbox/client/client.go
index c7dc2dbd..08b0de9a 100644
--- a/matchbox/client/client.go
+++ b/matchbox/client/client.go
@@ -3,6 +3,8 @@ package client
 import (
 	"crypto/tls"
 	"errors"
+	"fmt"
+	"net"
 	"time"
 
 	"google.golang.org/grpc"
@@ -40,6 +42,11 @@ func New(config *Config) (*Client, error) {
 	if len(config.Endpoints) == 0 {
 		return nil, errNoEndpoints
 	}
+	for _, endpoint := range config.Endpoints {
+		if _, _, err := net.SplitHostPort(endpoint); err != nil {
+			return nil, fmt.Errorf("client: invalid host:port endpoint: %v", err)
+		}
+	}
 	return newClient(config)
 }
 
diff --git a/matchbox/client/client_test.go b/matchbox/client/client_test.go
index 4c79d159..d80a369a 100644
--- a/matchbox/client/client_test.go
+++ b/matchbox/client/client_test.go
@@ -14,3 +14,20 @@ func TestNew_MissingEndpoints(t *testing.T) {
 	assert.Nil(t, client)
 	assert.Equal(t, errNoEndpoints, err)
 }
+
+// gRPC expects host:port with no scheme (e.g. matchbox.example.com:8081)
+func TestNew_InvalidEndpoints(t *testing.T) {
+	invalid := []string{
+		"matchbox.example.com",
+		"http://matchbox.example.com:8081",
+		"https://matchbox.example.com:8081",
+	}
+
+	for _, endpoint := range invalid {
+		client, err := New(&Config{
+			Endpoints: []string{endpoint},
+		})
+		assert.Nil(t, client)
+		assert.Error(t, err)
+	}
+}