{"record":{"id":"11224ca01a4965dc","repo":"cloudflare/cloudflared","slug":"empty-application-token","errorCode":null,"errorMessage":"empty application token","messagePattern":"empty application token","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/access/cmd.go","lineNumber":276,"sourceCode":"\t}\n\n\tappInfo, err := token.GetAppInfo(appURL)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif err := verifyTokenAtEdge(appURL, appInfo, c, log); err != nil {\n\t\tlog.Err(err).Msg(\"Could not verify token\")\n\t\treturn err\n\t}\n\n\tcfdToken, err := token.GetAppTokenIfExists(appInfo)\n\tif err != nil {\n\t\tfmt.Fprintln(os.Stderr, \"Unable to find token for provided application.\")\n\t\treturn err\n\t} else if cfdToken == \"\" {\n\t\tfmt.Fprintln(os.Stderr, \"token for provided application was empty.\")\n\t\treturn errors.New(\"empty application token\")\n\t}\n\n\tif c.Bool(loginQuietFlag) {\n\t\treturn nil\n\t}\n\n\t// Chatty by default for backward compat. The new --app flag\n\t// is an implicit opt-out of the backwards-compatible chatty output.\n\tif c.Bool(\"no-verbose\") || c.IsSet(appURLFlag) {\n\t\tfmt.Fprint(os.Stdout, cfdToken)\n\t} else {\n\t\tfmt.Fprintf(os.Stdout, \"Successfully fetched your token:\\n\\n%s\\n\\n\", cfdToken)\n\t}\n\n\treturn nil\n}\n\n// curl provides a wrapper around curl, passing Access JWT along in request","sourceCodeStart":258,"sourceCodeEnd":294,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/access/cmd.go#L258-L294","documentation":"The access login command retrieves an Access application token via token.GetAppTokenIfExists; if the token comes back empty it treats this as a hard failure with this error. It means Cloudflare Access did not issue a usable token for the given application URL even though no explicit error was raised.","triggerScenarios":"Running `cloudflared access login <app-url>` when the browser/device flow returns no token: the user is not authorized for the application, the app URL is wrong, or the local token store returned an empty value.","commonSituations":"Access policies not granting the current identity; expired or cleared browser session during login; mistyped application URL pointing at a non-Access route; corporate SSO flow silently failing.","solutions":["Re-run `cloudflared access login <url>` and complete the browser authentication fully","Verify your identity is permitted by the application's Access policy","Confirm the URL points to an application protected by Cloudflare Access","Clear cloudflared's local token store and retry to avoid stale empty entries"],"exampleFix":"// before\n# failing: cloudflared access login https://app.example.com\n// after\n# ensure policy grants your email, then:\n# cloudflared access login https://app.example.com\n# or generate a service token and use it:\n# export TUNNEL_SERVICE_TOKEN_ID=...; export TUNNEL_SERVICE_TOKEN_SECRET=...","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"err := loginApp(ctx, appURL)\nif err != nil && strings.Contains(err.Error(), \"empty application token\") {\n    // prompt re-authentication or fall back to service tokens\n    return fmt.Errorf(\"no Access token issued for %s; check policies: %w\", appURL, err)\n}","preventionTips":["Verify Access policies include your identity before login","Complete the full browser SSO flow without aborting","Prefer service tokens for headless/CI environments","Clear stale local token store entries when login behaves oddly"],"tags":["access","auth","token","cli"],"backgroundTag":"missing-credentials","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}