{"record":{"id":"48a27fcf897dccb4","repo":"cloudflare/cloudflared","slug":"could-not-write-token-to-configuration-directory-48a27f","errorCode":null,"errorMessage":"could not write token to configuration directory: %w","messagePattern":"could not write token to configuration directory: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/macos_service.go","lineNumber":185,"sourceCode":"\t\t// shadow the outer one, causing the defer below to not have access to\n\t\t// the outer err\n\t\tvar cp string\n\t\tcp, err = configPath()\n\t\tif err != nil {\n\t\t\tlog.Err(err).Msg(\"Error determining path to config directory\")\n\t\t\treturn err\n\t\t}\n\n\t\t// Ensure token file is removed if install fails at any point from now\n\t\t// on\n\t\tdefer func() {\n\t\t\tif err != nil {\n\t\t\t\tremoveTokenFile(cp, log)\n\t\t\t}\n\t\t}()\n\n\t\tif err = writeTokenToConfigDir(c, cp); err != nil {\n\t\t\treturn fmt.Errorf(\"could not write token to configuration directory: %w\", err)\n\t\t}\n\n\t\textraArgs = buildArgsForTokenFile(cp)\n\t}\n\n\tstdoutPath, err := stdoutPath()\n\tif err != nil {\n\t\tlog.Err(err).Msg(\"error determining stdout path\")\n\t\treturn errors.Wrap(err, \"error determining stdout path\")\n\t}\n\tstderrPath, err := stderrPath()\n\tif err != nil {\n\t\tlog.Err(err).Msg(\"error determining stderr path\")\n\t\treturn errors.Wrap(err, \"error determining stderr path\")\n\t}\n\tlaunchdTemplate := newLaunchdTemplate(installPath, stdoutPath, stderrPath)\n\ttemplateArgs := ServiceTemplateArgs{Path: etPath, ExtraArgs: extraArgs}\n\terr = launchdTemplate.Generate(&templateArgs)","sourceCodeStart":167,"sourceCodeEnd":203,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/macos_service.go#L167-L203","documentation":"When `cloudflared service install <token>` is used on macOS, installLaunchd writes the tunnel token to a file inside the Application Support config directory via writeTokenToConfigDir. This error wraps any failure of that write, which covers both creating the directory and writing the token file. A deferred cleanup removes the token file so a failed install leaves no secrets behind.","triggerScenarios":"Running `cloudflared service install <token>` on macOS when writeTokenToConfigDir fails: the Application Support directory cannot be created (permission denied, read-only volume, disk full), or the token file cannot be written/created.","commonSituations":"Installing as a user whose ~/Library/Application Support is not writable; running under sudo with a sandboxed/restricted HOME; full disk; corporate MDM policies blocking writes to Application Support.","solutions":["Check the wrapped error for permission denied and fix ownership/permissions on ~/Library/Application Support (or the root user's equivalent when installing as root)","Verify the disk is not full and the volume is writable","Ensure the HOME of the executing user resolves correctly (sudo may change HOME; use `sudo -H` if needed)","Retry the install; on failure the token file is auto-removed, so no stale token should block a retry","As a workaround, install without a token and use a config file instead"],"exampleFix":"// before (fails when HOME is wrong under sudo)\nsudo cloudflared service install <token>\n\n// after (preserves user's writable HOME)\nsudo -H cloudflared service install <token>","handlingStrategy":"validation","validationCode":"// Go: pre-check config dir writability before install\nfunc configDirWritable(dir string) error {\n    if err := os.MkdirAll(dir, 0o700); err != nil { return err }\n    probe := filepath.Join(dir, \".probe\")\n    if err := os.WriteFile(probe, []byte(\"ok\"), 0o600); err != nil { return err }\n    return os.Remove(probe)\n}","typeGuard":null,"tryCatchPattern":"if err := writeTokenToConfigDir(c, cp); err != nil {\n    if errors.Is(err, fs.ErrPermission) {\n        log.Printf(\"cannot write token to %s: check ownership/permissions or use sudo -H\", cp)\n    }\n    return fmt.Errorf(\"could not write token to configuration directory: %w\", err)\n}","preventionTips":["Use `sudo -H` so the config directory resolves to a writable home","Keep free disk space on the volume holding ~/Library/Application Support","Pre-flight check that the Application Support directory exists and is writable before scripted installs"],"tags":["macos","launchd","token","file-write"],"backgroundTag":"file-write-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}