{"record":{"id":"857fac357412dfad","repo":"cloudflare/cloudflared","slug":"failed-to-generate-app-token-file-path","errorCode":null,"errorMessage":"failed to generate app token file path","messagePattern":"failed to generate app token file path","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"token/token.go","lineNumber":343,"sourceCode":"func FetchTokenWithRedirect(appURL *url.URL, appInfo *AppInfo, autoClose bool, isFedramp bool, log *zerolog.Logger) (string, error) {\n\treturn getToken(appURL, appInfo, false, autoClose, isFedramp, log)\n}\n\n// FetchToken will either load a stored token or generate a new one\n// it appends the host of the appURL as the redirect URL to the access cli request if opening the browser\nfunc FetchToken(appURL *url.URL, appInfo *AppInfo, autoClose bool, isFedramp bool, log *zerolog.Logger) (string, error) {\n\treturn getToken(appURL, appInfo, true, autoClose, isFedramp, log)\n}\n\n// getToken will either load a stored token or generate a new one\nfunc getToken(appURL *url.URL, appInfo *AppInfo, useHostOnly bool, autoClose bool, isFedramp bool, log *zerolog.Logger) (string, error) {\n\tif token, err := GetAppTokenIfExists(appInfo); token != \"\" && err == nil {\n\t\treturn token, nil\n\t}\n\n\tappTokenPath, err := GenerateAppTokenFilePathFromURL(appInfo.AppHostname, appInfo.AppAUD, keyName)\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"failed to generate app token file path\")\n\t}\n\n\tappTokenLock, err := acquireLockFile(appTokenPath, log)\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"failed to acquire app token lock\")\n\t}\n\tdefer appTokenLock.release()\n\n\t// check to see if another process has gotten a token while we waited for the lock\n\tif token, err := GetAppTokenIfExists(appInfo); token != \"\" && err == nil {\n\t\treturn token, nil\n\t}\n\n\t// If an app token couldn't be found on disk, check for an org token and attempt to exchange it for an app token.\n\tvar orgTokenPath string\n\torgToken, orgTokenErr := GetOrgTokenIfExists(appInfo.AuthDomain)\n\tif orgTokenErr != nil {\n\t\torgTokenPath, err = generateOrgTokenFilePathFromURL(appInfo.AuthDomain)","sourceCodeStart":325,"sourceCodeEnd":361,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/token/token.go#L325-L361","documentation":"getToken wraps this error when GenerateAppTokenFilePathFromURL fails to derive the on-disk path where the app token should be cached. Path generation can fail when the app hostname or AUD produces an invalid file path (e.g. unsafe characters, URL parsing failure). Without a path, the token cannot be cached or locked.","triggerScenarios":"Calling FetchToken / FetchTokenWithRedirect -> getToken where GenerateAppTokenFilePathFromURL(appInfo.AppHostname, appInfo.AppAUD, keyName) returns an error — typically because AppHostname or the AUD cannot be converted into a safe filename.","commonSituations":"Malformed or empty AppHostname in tunnel/origin configuration; unusual characters in the hostname or AUD after a configuration change; corrupted originRequest config in the tunnel YAML feeding an unexpected hostname value.","solutions":["Inspect the wrapped cause to see which input (hostname, AUD, keyName) was rejected","Verify the app hostname in the tunnel configuration is a valid hostname with no scheme, path, or port oddities","Ensure AppAUD is set to the expected access application AUD string with no stray whitespace","Confirm the token storage directory configuration is sane; then retry the token fetch"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// validate hostname before token fetch\nif appInfo.AppHostname == \"\" || strings.ContainsAny(appInfo.AppHostname, \"/: \") {\n\treturn fmt.Errorf(\"invalid app hostname for token path: %q\", appInfo.AppHostname)\n}","typeGuard":null,"tryCatchPattern":"token, err := FetchToken(appURL, appAUD, keyName, useHostOnly, autoClose, isFedramp, log)\nif err != nil && strings.Contains(err.Error(), \"failed to generate app token file path\") {\n\t// configuration problem: inspect AppHostname/AppAUD in tunnel config\n\tlog.Error().Err(err).Str(\"hostname\", appInfo.AppHostname).Msg(\"bad token path inputs\")\n}","preventionTips":["Keep AppHostname a bare hostname (no scheme/path/port) in tunnel config","Validate config files with cloudflared tunnel ingress validation before deploy","Avoid whitespace or unicode in AUD values from external sources","Diff token-path inputs after config migrations"],"tags":["filesystem","token","path","config"],"backgroundTag":"invalid-url-format","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}