{"record":{"id":"712d30a8f95c9681","repo":"cloudflare/cloudflared","slug":"invalid-management-token-format-provided","errorCode":null,"errorMessage":"invalid management token format provided","messagePattern":"invalid management token format provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"management/token.go","lineNumber":56,"sourceCode":"// verify checks the ID claim isn't empty\nfunc (t *actor) verify() bool {\n\treturn t.ID != \"\"\n}\n\nfunc ParseToken(token string) (*managementTokenClaims, error) {\n\tjwt, err := jwt.ParseSigned(token, []jose.SignatureAlgorithm{jose.ES256})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"malformed jwt: %v\", err)\n\t}\n\n\tvar claims managementTokenClaims\n\t// This is actually safe because we verify the token in the edge before it reaches cloudflared\n\terr = jwt.UnsafeClaimsWithoutVerification(&claims)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"malformed jwt: %v\", err)\n\t}\n\tif !claims.verify() {\n\t\treturn nil, fmt.Errorf(\"invalid management token format provided\")\n\t}\n\treturn &claims, nil\n}\n\nfunc (m *managementTokenClaims) IsFed() bool {\n\treturn m.Issuer == tunnelstoreFEDIssuer\n}\n","sourceCodeStart":38,"sourceCodeEnd":64,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/management/token.go#L38-L64","documentation":"Raised by management.ParseToken when the token parses as a JWT but its claims fail verification: the tunnel claim requires a non-empty AccountTag and ID (and the actor claim a non-empty ID). The token is structurally valid but semantically incomplete, so it cannot identify a tunnel for the management connection.","triggerScenarios":"Thrown at management/token.go:56 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Obtain a fresh management token — this one is missing required claims (account tag / tunnel ID).","Verify the token came from the correct Cloudflare account and access flow.","Do not hand-edit token contents; claims are produced by the edge."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}