{"record":{"id":"a0371cb167f38d2e","repo":"cloudflare/cloudflared","slug":"failed-to-remove-cached-token-with-unexpected-audi","errorCode":null,"errorMessage":"failed to remove cached token with unexpected audience: %w","messagePattern":"failed to remove cached token with unexpected audience: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"token/token.go","lineNumber":628,"sourceCode":"\t\treturn \"\", err\n\t}\n\ttoken, err := getTokenIfExists(path)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tvar payload jwtPayload\n\terr = json.Unmarshal(token.UnsafePayloadWithoutVerification(), &payload)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\tif payload.isExpired() {\n\t\terr := os.Remove(path)\n\t\treturn \"\", err\n\t}\n\tif !slices.Contains(payload.Aud, appInfo.AppAUD) {\n\t\tif err := os.Remove(path); err != nil && !os.IsNotExist(err) {\n\t\t\treturn \"\", fmt.Errorf(\"failed to remove cached token with unexpected audience: %w\", err)\n\t\t}\n\t\treturn \"\", fmt.Errorf(\"cached token audience does not include expected application audience %q\", appInfo.AppAUD)\n\t}\n\n\treturn token.CompactSerialize()\n}\n\n// GetTokenIfExists will return the token from local storage if it exists and not expired\nfunc getTokenIfExists(path string) (*jose.JSONWebSignature, error) {\n\tcontent, err := os.ReadFile(path) // nolint: gosec\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\ttoken, err := jose.ParseSigned(string(content), signatureAlgs)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn token, nil","sourceCodeStart":610,"sourceCodeEnd":646,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/token/token.go#L610-L646","documentation":"GetAppTokenIfExists found a cached Access token on disk whose audience (Aud claim) does not match the application the user is trying to reach. cloudflared attempts to delete the stale cache file so a fresh token can be minted; this error is thrown when that os.Remove fails with a non-FileNotFound error. The user cannot proceed until the bad cache file is cleared.","triggerScenarios":"Calling GetAppTokenIfExists (via login, curl, or generateToken) when (1) the cached token's aud claim differs from appInfo.AppAUD and (2) os.Remove(path) fails for a reason other than the file not existing.","commonSituations":"Cache file permissions changed or file locked by another process (Windows AV/indexer holding the file), read-only filesystem, or a stale cache written by a different Access application under the same cache directory.","solutions":["Manually delete the cached token file in the cloudflared token cache directory and re-run login.","Check filesystem permissions/write access on the cache directory and file.","On Windows, close processes (AV scanners, editors) holding the cache file open.","Ensure all Access apps use their correct AppAUD so the right cache path is used."],"exampleFix":"// before\nerr := os.Remove(path)\nreturn \"\", fmt.Errorf(\"failed to remove cached token with unexpected audience: %w\", err)\n// after\nif err := os.Remove(path); err != nil && !os.IsNotExist(err) {\n    return \"\", fmt.Errorf(\"failed to remove cached token with unexpected audience: %w\", err)\n}\n// proceed to fetch a new token for appInfo.AppAUD","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"token, err := token.GetAppTokenIfExists(appInfo)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed to remove cached token\") {\n        // delete the cache file manually or warn user about permissions\n    }\n    return err\n}","preventionTips":["Keep the token cache directory writable by the running user","Avoid running multiple cloudflared processes that share the same cache concurrently","Clear cache files when switching between Access applications"],"tags":["token-cache","filesystem","audience-mismatch"],"backgroundTag":"file-delete-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}