{"record":{"id":"15a47cccbf9c2f82","repo":"cloudflare/cloudflared","slug":"could-not-create-access-request","errorCode":null,"errorMessage":"Could not create access request","messagePattern":"Could not create access request","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/access/cmd.go","lineNumber":579,"sourceCode":"\n\tif err := token.RemoveTokenIfExists(appInfo); err != nil {\n\t\treturn err\n\t}\n\n\tif valid, err := isTokenValid(options, log); err != nil {\n\t\treturn err\n\t} else if !valid {\n\t\treturn errors.New(\"failed to verify token\")\n\t}\n\n\treturn nil\n}\n\n// isTokenValid makes a request to the origin and returns true if the response was not a 302.\nfunc isTokenValid(options *carrier.StartOptions, log *zerolog.Logger) (bool, error) {\n\treq, err := carrier.BuildAccessRequest(options, log)\n\tif err != nil {\n\t\treturn false, errors.Wrap(err, \"Could not create access request\")\n\t}\n\treq.Header.Set(\"User-Agent\", userAgent)\n\n\tquery := req.URL.Query()\n\tquery.Set(\"cloudflared_token_check\", \"true\")\n\treq.URL.RawQuery = query.Encode()\n\n\t// Do not follow redirects\n\tclient := &http.Client{\n\t\tCheckRedirect: func(req *http.Request, via []*http.Request) error {\n\t\t\treturn http.ErrUseLastResponse\n\t\t},\n\t\tTimeout: time.Second * 5,\n\t}\n\tresp, err := client.Do(req)\n\tif err != nil {\n\t\treturn false, err\n\t}","sourceCodeStart":561,"sourceCodeEnd":597,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/access/cmd.go#L561-L597","documentation":"isTokenValid (part of token verification at the edge) builds an HTTP request via carrier.BuildAccessRequest using the provided StartOptions. \"Could not create access request\" wraps any failure there — typically the options contain an unparseable origin URL or the request cannot be constructed. The error occurs before the request is sent, so it is local, not an edge rejection.","triggerScenarios":"Calling verifyTokenAtEdge/isTokenValid with StartOptions whose OriginURL (or AuthDomain/ServiceToken fields) cannot be turned into a valid http.Request — e.g., empty or malformed origin URL.","commonSituations":"Stale or hand-edited access token/config files referencing a deleted app; passing --app-url values without scheme; programmatic use of carrier.StartOptions with unset OriginURL.","solutions":["Re-authenticate with `cloudflared access login <app-url>` to regenerate a valid token/config.","Check that the origin/app URL in options is a full, well-formed URL (scheme + host).","Log the wrapped error with %+v to see BuildAccessRequest's underlying message.","If constructing StartOptions in code, validate url.Parse(OriginURL) succeeds before calling."],"exampleFix":"// before\nopts := &carrier.StartOptions{OriginURL: \"myapp.example.com\"}\n// after\nopts := &carrier.StartOptions{OriginURL: \"https://myapp.example.com\"}","handlingStrategy":"validation","validationCode":"if u, err := url.Parse(options.OriginURL); err != nil || u.Scheme == \"\" || u.Host == \"\" {\n\treturn fmt.Errorf(\"OriginURL must be an absolute URL, got %q\", options.OriginURL)\n}","typeGuard":null,"tryCatchPattern":"valid, err := isTokenValid(opts, log)\nif err != nil {\n\tlog.Err(err).Msgf(\"token check failed: %+v\", err)\n\treturn false, err\n}","preventionTips":["Use absolute URLs (https://) in StartOptions.OriginURL","Re-run `cloudflared access login` after app config changes","Validate options programmatically before building requests"],"tags":["access","http-request","url"],"backgroundTag":"api-request-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}