{"record":{"id":"a22ce6c7c0b7cf91","repo":"cloudflare/cloudflared","slug":"unable-to-acquire-management-token-for-requested-t","errorCode":null,"errorMessage":"unable to acquire management token for requested tunnel id: %w","messagePattern":"unable to acquire management token for requested tunnel id: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/tail/cmd.go","lineNumber":215,"sourceCode":"\t\treturn nil, nil\n\t}\n\n\treturn &management.StreamingFilters{\n\t\tLevel:    level,\n\t\tEvents:   events,\n\t\tSampling: sample,\n\t}, nil\n}\n\n// buildURL will build the management url to contain the required query parameters to authenticate the request.\nfunc buildURL(c *cli.Context, log *zerolog.Logger, res cfapi.ManagementResource) (url.URL, error) {\n\tvar err error\n\n\ttoken := c.String(\"token\")\n\tif token == \"\" {\n\t\ttoken, err = cliutil.GetManagementToken(c, log, res, buildInfo)\n\t\tif err != nil {\n\t\t\treturn url.URL{}, fmt.Errorf(\"unable to acquire management token for requested tunnel id: %w\", err)\n\t\t}\n\t}\n\n\tclaims, err := management.ParseToken(token)\n\tif err != nil {\n\t\treturn url.URL{}, fmt.Errorf(\"failed to determine if token is FED: %w\", err)\n\t}\n\n\tvar managementHostname string\n\tif claims.IsFed() {\n\t\tmanagementHostname = credentials.FedRampHostname\n\t} else {\n\t\tmanagementHostname = c.String(cfdflags.ManagementHostname)\n\t}\n\n\tquery := url.Values{}\n\tquery.Add(\"access_token\", token)\n\tconnector := c.String(\"connector-id\")","sourceCodeStart":197,"sourceCodeEnd":233,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/tail/cmd.go#L197-L233","documentation":"buildURL needs an Access management token to authenticate the tail session. When --token is not provided, it calls cliutil.GetManagementToken, which may require an Access login (cloudflared access login or an existing token file). Any failure there is wrapped with this message.","triggerScenarios":"Running `cloudflared tail <tunnel-id>` without --token when no cached Access token exists for the account/tunnel, the user is not authenticated to Access, or the browser-based Access flow fails (headless machine, browser launch failure).","commonSituations":"Running tail on a headless server without an Access token, using a token for a different account than the tunnel, expired cached credentials, or CF_API_TOKEN environments lacking management scope.","solutions":["Pass --token explicitly with a valid management/Access token","Run `cloudflared access login <access-url>` first to establish cached credentials","Re-authenticate if the cached token expired; verify the token belongs to the tunnel's account","On headless hosts, generate a service token via Cloudflare Zero Trust and supply it via --token"],"exampleFix":"# before\ncloudflared tail <tunnel-id>\n# after\ncloudflared tail --token $(cat ~/.cloudflared/management-token) <tunnel-id>","handlingStrategy":"fallback","validationCode":"if token == \"\" {\n\tif _, err := os.Stat(tokenCachePath); err != nil {\n\t\treturn errors.New(\"no management token; run `cloudflared access login` first\")\n\t}\n}","typeGuard":null,"tryCatchPattern":"_, err := buildURL(c, log, res, buildInfo)\nif err != nil && strings.Contains(err.Error(), \"management token\") {\n\t// prompt user to authenticate: cloudflared access login <url>\n\treturn err\n}","preventionTips":["Pass --token explicitly on headless machines","Establish Access credentials before running tail","Keep token files readable and unexpired","Ensure the token matches the tunnel's Cloudflare account"],"tags":["cli","auth","access","token"],"backgroundTag":"missing-credentials","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}