{"record":{"id":"8d0192a982c0995e","repo":"cloudflare/cloudflared","slug":"error-writing-token-credentials-to-json-file-in-pa","errorCode":null,"errorMessage":"error writing token credentials to JSON file in path %s","messagePattern":"error writing token credentials to JSON file in path (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/tunnel/subcommands.go","lineNumber":888,"sourceCode":"\n\tif c.NArg() != 1 {\n\t\treturn cliutil.UsageError(`\"cloudflared tunnel token\" requires exactly 1 argument, the name or UUID of tunnel to fetch the credentials token for.`)\n\t}\n\ttunnelID, err := sc.findID(c.Args().First())\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"error parsing tunnel ID\")\n\t}\n\n\ttoken, err := sc.getTunnelTokenCredentials(tunnelID)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif path := c.String(CredFileFlag); path != \"\" {\n\t\tcredentials := token.Credentials()\n\t\terr := writeTunnelCredentials(path, &credentials)\n\t\tif err != nil {\n\t\t\treturn errors.Wrapf(err, \"error writing token credentials to JSON file in path %s\", path)\n\t\t}\n\n\t\treturn nil\n\t}\n\n\tencodedToken, err := token.Encode()\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tfmt.Println(encodedToken)\n\treturn nil\n}\n\nfunc buildRouteCommand() *cli.Command {\n\treturn &cli.Command{\n\t\tName:      \"route\",\n\t\tUsage:     \"Define which traffic routed from Cloudflare edge to this tunnel: requests to a DNS hostname, to a Cloudflare Load Balancer, or traffic originating from Cloudflare WARP clients\",","sourceCodeStart":870,"sourceCodeEnd":906,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/tunnel/subcommands.go#L870-L906","documentation":"After fetching the tunnel token, tokenCommand optionally persists the decoded credentials as a JSON file when --cred-file is set. writeTunnelCredentials failing (serialization or file write) is wrapped with the target path in this message. It indicates the credentials JSON could not be written to the requested path.","triggerScenarios":"Running `cloudflared tunnel token --cred-file /path/creds.json <tunnel>` where the path's directory does not exist, the process lacks write permission, the path is a directory, or the disk is full.","commonSituations":"Pointing --cred-file at a read-only mount, a typo'd directory in the path, running under a service account without permission to the config directory, or container filesystems with a read-only root.","solutions":["Create the parent directory first: mkdir -p $(dirname <path>).","Check write permissions on the target directory for the user running cloudflared.","Write to a writable location (e.g. /etc/cloudflared or the user's home) and move the file with elevated permissions.","Omit --cred-file and capture the encoded token on stdout instead."],"exampleFix":"// before\ncloudflared tunnel token --cred-file /etc/cloudflared/creds.json my-tunnel\n// after\nsudo mkdir -p /etc/cloudflared && sudo chown $(whoami) /etc/cloudflared\ncloudflared tunnel token --cred-file /etc/cloudflared/creds.json my-tunnel","handlingStrategy":"validation","validationCode":"// Go: verify the destination is writable before invoking the command\nif err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {\n\treturn err\n}\nf, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY, 0o600)\nif err == nil {\n\tf.Close()\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pre-create and chown the credentials directory before running the command.","Run cloudflared as the same user that owns the config directory.","Avoid --cred-file on read-only container filesystems."],"tags":["cli","file-write","credentials","cloudflare"],"backgroundTag":"file-write-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}