{"record":{"id":"79f87ecf94a4f769","repo":"cloudflare/cloudflared","slug":"couldn-t-decode-tunnel-secret-from-base64","errorCode":null,"errorMessage":"Couldn't decode tunnel secret from base64","messagePattern":"Couldn't decode tunnel secret from base64","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/tunnel/subcommand_context.go","lineNumber":141,"sourceCode":"\treturn credentials, nil\n}\n\nfunc (sc *subcommandContext) create(name string, credentialsFilePath string, secret string) (*cfapi.Tunnel, error) {\n\tclient, err := sc.client()\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"couldn't create client to talk to Cloudflare Tunnel backend\")\n\t}\n\n\tvar tunnelSecret []byte\n\tif secret == \"\" {\n\t\ttunnelSecret, err = generateTunnelSecret()\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"couldn't generate the secret for your new tunnel\")\n\t\t}\n\t} else {\n\t\tdecodedSecret, err := base64.StdEncoding.DecodeString(secret)\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"Couldn't decode tunnel secret from base64\")\n\t\t}\n\t\ttunnelSecret = decodedSecret\n\t\tif len(tunnelSecret) < 32 {\n\t\t\treturn nil, errors.New(\"Decoded tunnel secret must be at least 32 bytes long\")\n\t\t}\n\t}\n\n\ttunnel, err := client.CreateTunnel(name, tunnelSecret)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"Create Tunnel API call failed\")\n\t}\n\n\tcredential, err := sc.credential()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\ttunnelCredentials := connection.Credentials{","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/tunnel/subcommand_context.go#L123-L159","documentation":"When a tunnel secret is supplied via --secret, create() decodes it from base64; if base64.StdEncoding.DecodeString fails, this wrapped error is returned. The secret must be valid standard-base64 and at least 32 bytes once decoded.","triggerScenarios":"`cloudflared tunnel create --secret <value>` where <value> contains characters outside the standard base64 alphabet or wrong padding.","commonSituations":"Passing a URL-safe base64 string (with - and _) instead of standard base64; trailing whitespace/newlines; shell mangling of special characters; reusing a raw hex or plaintext string as the secret.","solutions":["Regenerate the secret as standard base64 of >=32 random bytes: `head -c 32 /dev/urandom | base64`","Quote the secret in the shell to avoid character mangling","If the value uses URL-safe base64, convert it (replace -/_, restore padding) to standard base64","Ensure no trailing newline/whitespace is included (e.g. strip with tr -d '\\n')"],"exampleFix":"// before\ncloudflared tunnel create --secret \"abc-123_xyz\" mytunnel\n// after\nSECRET=$(head -c 32 /dev/urandom | base64)\ncloudflared tunnel create --secret \"$SECRET\" mytunnel","handlingStrategy":"validation","validationCode":"decoded, err := base64.StdEncoding.DecodeString(secret)\nif err != nil {\n    return fmt.Errorf(\"--secret must be standard base64: %w\", err)\n}\nif len(decoded) < 32 {\n    return fmt.Errorf(\"--secret must decode to at least 32 bytes, got %d\", len(decoded))\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Generate secrets with `head -c 32 /dev/urandom | base64`","Quote secrets in shell to prevent mangling","Strip whitespace/newlines from secret files"],"tags":["go","base64","cli","validation"],"backgroundTag":"invalid-argument-format","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}