{"record":{"id":"333306d358ce0997","repo":"cloudflare/cloudflared","slug":"region-provided-with-a-token-that-has-an-endpoint","errorCode":null,"errorMessage":"region provided with a token that has an endpoint","messagePattern":"region provided with a token that has an endpoint","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/tunnel/configuration.go","lineNumber":198,"sourceCode":"\t\treturn nil, nil, err\n\t}\n\tif err := testIPBindable(edgeBindAddr); err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"invalid edge-bind-address %s: %v\", edgeBindAddr, err)\n\t}\n\tedgeIPVersion, err = adjustIPVersionByBindAddress(edgeIPVersion, edgeBindAddr)\n\tif err != nil {\n\t\t// This is not a fatal error, we just overrode edgeIPVersion\n\t\tlog.Warn().Str(\"edgeIPVersion\", edgeIPVersion.String()).Err(err).Msg(\"Overriding edge-ip-version\")\n\t}\n\n\tregion := c.String(flags.Region)\n\tendpoint := namedTunnel.Credentials.Endpoint\n\tvar resolvedRegion string\n\t// set resolvedRegion to either the region passed as argument\n\t// or to the endpoint in the credentials.\n\t// Region and endpoint are interchangeable\n\tif region != \"\" && endpoint != \"\" {\n\t\treturn nil, nil, fmt.Errorf(\"region provided with a token that has an endpoint\")\n\t} else if region != \"\" {\n\t\tresolvedRegion = region\n\t} else if endpoint != \"\" {\n\t\tresolvedRegion = endpoint\n\t}\n\n\twarpRoutingConfig := ingress.NewWarpRoutingConfig(&cfg.WarpRouting)\n\n\t// Setup origin dialer service and virtual services\n\toriginDialerService := ingress.NewOriginDialer(ingress.OriginConfig{\n\t\tDefaultDialer:   ingress.NewDialer(warpRoutingConfig),\n\t\tTCPWriteTimeout: c.Duration(flags.WriteStreamTimeout),\n\t}, log)\n\n\t// Setup DNS Resolver Service\n\toriginMetrics := origins.NewMetrics(prometheus.DefaultRegisterer)\n\tdnsResolverAddrs := c.StringSlice(flags.VirtualDNSServiceResolverAddresses)\n\tdnsService := origins.NewDNSResolverService(origins.NewDNSDialer(), log, originMetrics)","sourceCodeStart":180,"sourceCodeEnd":216,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/tunnel/configuration.go#L180-L216","documentation":"Region and the endpoint embedded in remotely-managed tunnel credentials are interchangeable; specifying `--region` while the token's credentials already carry an endpoint is ambiguous, so prepareTunnelConfig rejects the combination.","triggerScenarios":"Running `cloudflared tunnel run --region us --token <token>` where the token was issued with an explicit endpoint baked into its credentials (Endpoint field non-empty).","commonSituations":"Users in non-US regions adding `--region` on top of a pre-provisioned token that already targets a specific endpoint; copy-pasted run commands from different environments.","solutions":["Drop the `--region` flag and let the token's embedded endpoint decide the region.","Or request/issue a token without an embedded endpoint if you must control region via the flag.","Check the credentials/token payload's endpoint field to confirm which region it targets before running."],"exampleFix":"// before\ncloudflared tunnel run --region us --token $TUNNEL_TOKEN\n// after\ncloudflared tunnel run --token $TUNNEL_TOKEN","handlingStrategy":"validation","validationCode":"// shell: never pass --region when using a remotely-provisioned token\nargs=(tunnel run --token \"$TUNNEL_TOKEN\")\n[ -z \"$REGION\" ] || args+=(--region \"$REGION\")  # only for locally-managed tunnels\nexec cloudflared \"${args[@]}\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat token-provided endpoint and --region as mutually exclusive.","Document in runbooks: region flag is for locally-managed tunnels only.","Inspect the token's credentials endpoint field before adding --region."],"tags":["cli","configuration","region"],"backgroundTag":"mutually-exclusive-options","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}