{"record":{"id":"9250d192272941c1","repo":"cloudflare/cloudflared","slug":"failed-to-create-app-token-request","errorCode":null,"errorMessage":"failed to create app token request","messagePattern":"failed to create app token request","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"token/token.go","lineNumber":561,"sourceCode":"\tif len(via) > 0 && strings.Contains(via[len(via)-1].URL.Path, AccessAuthorizedWorkerPath) {\n\t\treturn http.ErrUseLastResponse\n\t}\n\treturn nil\n}\n\n// exchangeOrgToken attaches an org token to a request to the appURL and returns an app token. This uses the Access SSO\n// flow to automatically generate and return an app token without the login page.\nfunc exchangeOrgToken(appURL *url.URL, orgToken string) (string, error) {\n\tclient := &http.Client{\n\t\tCheckRedirect: func(req *http.Request, via []*http.Request) error {\n\t\t\treturn handleRedirects(req, via, orgToken)\n\t\t},\n\t\tTimeout: time.Second * 7,\n\t}\n\n\tappTokenRequest, err := http.NewRequest(\"HEAD\", appURL.String(), nil)\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"failed to create app token request\")\n\t}\n\tappTokenRequest.Header.Add(userAgentHeader, userAgent)\n\tresp, err := client.Do(appTokenRequest) // nolint: gosec\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"failed to get app token\")\n\t}\n\t_ = resp.Body.Close()\n\tvar appToken string\n\tfor _, c := range resp.Cookies() {\n\t\t//if Org token revoked on exchange, getTokensFromEdge instead\n\t\tvalidAppToken := c.Name == tokenCookie && time.Now().Before(c.Expires)\n\t\tif validAppToken {\n\t\t\tappToken = c.Value\n\t\t\tbreak\n\t\t}\n\t}\n\n\tif len(appToken) > 0 {","sourceCodeStart":543,"sourceCodeEnd":579,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/token/token.go#L543-L579","documentation":"This error wraps a failure from http.NewRequest(\"HEAD\", appURL.String(), nil) inside exchangeOrgToken, which builds the request used to exchange an org token for an app token. Like all http.NewRequest failures it indicates malformed request input — almost always an unparseable URL. The wrapped err identifies the exact parse problem.","triggerScenarios":"exchangeOrgToken (via getToken) constructs appURL and http.NewRequest fails — the org-token response's aud/APP connection info yielded a URL that fails parsing (missing/invalid scheme, invalid characters).","commonSituations":"Corrupted or unexpected edge token response producing a bad app URL; malformed configuration of the Access application domain; manual tampering with the token file containing a broken URL field.","solutions":["Delete the cached org token file and re-authenticate so a fresh, valid edge response regenerates appURL","Verify the Access application's domain configuration in the Cloudflare Zero Trust dashboard is a well-formed https URL","Log/inspect appURL.String() before the request to spot malformed values","Re-run the login flow (cloudflared access login) to refresh connection metadata"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if u, err := url.Parse(appURL.String()); err != nil || u.Scheme == \"\" || u.Host == \"\" {\n\t// corrupted token metadata: delete cached org token and re-authenticate\n\tos.Remove(orgTokenPath)\n}","typeGuard":null,"tryCatchPattern":"appToken, err := getToken(ctx, log)\nif err != nil && strings.Contains(err.Error(), \"failed to create app token request\") {\n\t// discard cached org token and re-run the full login flow\n}","preventionTips":["Re-authenticate after any Zero Trust app domain config change","Never hand-edit cached token files","Log the app URL on failure to diagnose stale metadata","Refresh tokens rather than reusing very old cached org tokens"],"tags":["http","url","token","validation"],"backgroundTag":"invalid-url-format","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}