{"record":{"id":"8f85f13418f746bc","repo":"cloudflare/cloudflared","slug":"response-from-s-did-not-contain-app-token","errorCode":null,"errorMessage":"response from %s did not contain app token","messagePattern":"response from (.+?) did not contain app token","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"token/token.go","lineNumber":582,"sourceCode":"\tresp, err := client.Do(appTokenRequest) // nolint: gosec\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"failed to get app token\")\n\t}\n\t_ = resp.Body.Close()\n\tvar appToken string\n\tfor _, c := range resp.Cookies() {\n\t\t//if Org token revoked on exchange, getTokensFromEdge instead\n\t\tvalidAppToken := c.Name == tokenCookie && time.Now().Before(c.Expires)\n\t\tif validAppToken {\n\t\t\tappToken = c.Value\n\t\t\tbreak\n\t\t}\n\t}\n\n\tif len(appToken) > 0 {\n\t\treturn appToken, nil\n\t}\n\treturn \"\", fmt.Errorf(\"response from %s did not contain app token\", resp.Request.URL.String())\n}\n\nfunc GetOrgTokenIfExists(authDomain string) (string, error) {\n\tpath, err := generateOrgTokenFilePathFromURL(authDomain)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\ttoken, err := getTokenIfExists(path)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tvar payload jwtPayload\n\terr = json.Unmarshal(token.UnsafePayloadWithoutVerification(), &payload)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\tif payload.isExpired() {","sourceCodeStart":564,"sourceCodeEnd":600,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/token/token.go#L564-L600","documentation":"exchangeOrgToken posts the organization (Cloudflare Access) token to the app's token endpoint to obtain an app-specific token. If the HTTP exchange succeeds but the response body/headers contain no app token, the function fails with this error naming the request URL. It means Cloudflare accepted the org token but did not grant an application token for that request.","triggerScenarios":"Calling getToken when the token-exchange response has no app token — the user's Access policy does not include an application rule allowing them in, the org token is for a different team domain/audience than the app, or the app requires additional authentication (e.g. service token headers, mTLS, WAF country rule) that was not supplied.","commonSituations":"Developer not added to the Access application's policy (or policy recently changed); using an org token cached from a previous login to a different team; accessing an app configured for service-token-only auth while authenticating as a browser user; audience (AUD) mismatch after the app was recreated.","solutions":["Verify your identity/email is listed in the Access application's policy in the Zero Trust dashboard and re-login with `cloudflared access login <url>` to refresh the org token.","Check the app's AUD/audience: delete the stale org token file and re-authenticate against the correct team domain.","If the app requires a service token, provide the CF-Access-Client-Id / CF-Access-Client-Secret headers instead of relying on the browser org token.","Confirm the response from the token endpoint (status + body) with debug logging to see whether Cloudflare returned a policy-denial page.","Recreate or fix the Access application if its audience/policy was recently changed."],"exampleFix":"// before\nexported, err := token.GetOrgTokenIfExists(authDomain)\nappToken, err := token.getToken(appURL, exported, ...) // response did not contain app token\n// after — force a fresh login for the right team domain\nos.Remove(orgTokenPath)\norgToken, err := token.GetOrgToken(authDomain)\nappToken, err := token.getToken(appURL, orgToken, ...)","handlingStrategy":"try-catch","validationCode":"// verify an org token exists and was issued for this team domain before exchanging\norgToken, err := token.GetOrgTokenIfExists(authDomain)\nif err != nil || orgToken == \"\" {\n    return errors.New(\"no valid org token; run cloudflared access login <app-url> first\")\n}","typeGuard":null,"tryCatchPattern":"appToken, err := token.getToken(appURL, orgToken, ...)\nif err != nil {\n    if strings.Contains(err.Error(), \"did not contain app token\") {\n        // most likely policy denial: force re-login and surface guidance\n        return fmt.Errorf(\"%w — ensure your identity is allowed by the app's Access policy; re-run access login\", err)\n    }\n    return err\n}","preventionTips":["Confirm your user/email (or service token) is in the app's Access policy before exchanging tokens.","Re-login whenever the Access application or its AUD changes; don't reuse stale org token files.","For service-token apps, always send CF-Access-Client-Id/Secret headers.","Enable debug logging to inspect the exchange response body for policy-denial clues."],"tags":["auth","cloudflare-access","token-exchange","http"],"backgroundTag":"oauth-token-exchange-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}