{"record":{"id":"0f56d2345134d695","repo":"cloudflare/cloudflared","slug":"couldn-t-create-client-to-talk-to-cloudflare-tunne","errorCode":null,"errorMessage":"couldn't create client to talk to Cloudflare Tunnel backend","messagePattern":"couldn't create client to talk to Cloudflare Tunnel backend","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/tunnel/subcommand_context.go","lineNumber":129,"sourceCode":"\t}\n\n\tvar credentials connection.Credentials\n\tif err = json.Unmarshal(body, &credentials); err != nil {\n\t\tif filepath.Ext(filePath) == \".pem\" {\n\t\t\treturn connection.Credentials{}, fmt.Errorf(\"The tunnel credentials file should be .json but you gave a .pem. \" +\n\t\t\t\t\"The tunnel credentials file was originally created by `cloudflared tunnel create`. \" +\n\t\t\t\t\"You may have accidentally used the filepath to cert.pem, which is generated by `cloudflared tunnel \" +\n\t\t\t\t\"login`.\")\n\t\t}\n\t\treturn connection.Credentials{}, invalidJSONCredentialError{path: filePath, err: err}\n\t}\n\treturn credentials, nil\n}\n\nfunc (sc *subcommandContext) create(name string, credentialsFilePath string, secret string) (*cfapi.Tunnel, error) {\n\tclient, err := sc.client()\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"couldn't create client to talk to Cloudflare Tunnel backend\")\n\t}\n\n\tvar tunnelSecret []byte\n\tif secret == \"\" {\n\t\ttunnelSecret, err = generateTunnelSecret()\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"couldn't generate the secret for your new tunnel\")\n\t\t}\n\t} else {\n\t\tdecodedSecret, err := base64.StdEncoding.DecodeString(secret)\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"Couldn't decode tunnel secret from base64\")\n\t\t}\n\t\ttunnelSecret = decodedSecret\n\t\tif len(tunnelSecret) < 32 {\n\t\t\treturn nil, errors.New(\"Decoded tunnel secret must be at least 32 bytes long\")\n\t\t}\n\t}","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/tunnel/subcommand_context.go#L111-L147","documentation":"create() could not construct the Cloudflare API client (sc.client()). The client is built from the account token/origincert and API URL; any failure assembling it (bad credentials source, config, or HTTP client setup) is wrapped with this message.","triggerScenarios":"sc.client() returns an error inside subcommandContext.create, invoked by runAdhocNamedTunnel (`cloudflared tunnel create <name>`).","commonSituations":"Missing or invalid ~/.cloudflared/cert.pem (not logged in with `cloudflared tunnel login`); malformed api-url override; TUNNEL_TOKEN vs cert confusion in CI environments.","solutions":["Run `cloudflared tunnel login` to obtain a valid origin certificate","Verify ~/.cloudflared/cert.pem exists and is readable, or set TUNNEL_ORIGIN_CERT to a valid path","Check api-url / TUNNEL_API_URL overrides for typos","Ensure the cert matches an account you can create tunnels in"],"exampleFix":"// before\n$ cloudflared tunnel create mytunnel   # no cert.pem\n// after\n$ cloudflared tunnel login\n$ cloudflared tunnel create mytunnel","handlingStrategy":"validation","validationCode":"if _, err := os.Stat(certPath); os.IsNotExist(err) {\n    return fmt.Errorf(\"run `cloudflared tunnel login` first; %s not found\", certPath)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run `cloudflared tunnel login` before tunnel create in CI/VMs","Set TUNNEL_ORIGIN_CERT explicitly in automation","Verify api-url overrides"],"tags":["go","api","client","authentication"],"backgroundTag":"missing-credentials","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}