{"record":{"id":"ad2b1808177148a5","repo":"cloudflare/cloudflared","slug":"failed-to-determine-if-token-is-fed-w","errorCode":null,"errorMessage":"failed to determine if token is FED: %w","messagePattern":"failed to determine if token is FED: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/tail/cmd.go","lineNumber":221,"sourceCode":"\t\tSampling: sample,\n\t}, nil\n}\n\n// buildURL will build the management url to contain the required query parameters to authenticate the request.\nfunc buildURL(c *cli.Context, log *zerolog.Logger, res cfapi.ManagementResource) (url.URL, error) {\n\tvar err error\n\n\ttoken := c.String(\"token\")\n\tif token == \"\" {\n\t\ttoken, err = cliutil.GetManagementToken(c, log, res, buildInfo)\n\t\tif err != nil {\n\t\t\treturn url.URL{}, fmt.Errorf(\"unable to acquire management token for requested tunnel id: %w\", err)\n\t\t}\n\t}\n\n\tclaims, err := management.ParseToken(token)\n\tif err != nil {\n\t\treturn url.URL{}, fmt.Errorf(\"failed to determine if token is FED: %w\", err)\n\t}\n\n\tvar managementHostname string\n\tif claims.IsFed() {\n\t\tmanagementHostname = credentials.FedRampHostname\n\t} else {\n\t\tmanagementHostname = c.String(cfdflags.ManagementHostname)\n\t}\n\n\tquery := url.Values{}\n\tquery.Add(\"access_token\", token)\n\tconnector := c.String(\"connector-id\")\n\tif connector != \"\" {\n\t\tconnectorID, err := uuid.Parse(connector)\n\t\tif err != nil {\n\t\t\treturn url.URL{}, fmt.Errorf(\"unabled to parse 'connector-id' flag into a valid UUID: %w\", err)\n\t\t}\n\t\tquery.Add(\"connector_id\", connectorID.String())","sourceCodeStart":203,"sourceCodeEnd":239,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/tail/cmd.go#L203-L239","documentation":"After obtaining the token, buildURL calls management.ParseToken to decode the JWT and check whether the account is FedRAMP (IsFed) so it can pick the correct management hostname. An unparseable token produces this error.","triggerScenarios":"--token is provided with a value that is not a valid JWT (raw API key, truncated string, base64-without-JWT, whitespace/newlines), or the token came from a non-Access source.","commonSituations":"Pasting a Cloudflare API token or tunnel token instead of an Access management JWT; copying the token with surrounding quotes; token corruption in scripts.","solutions":["Verify --token contains a valid Access management JWT (three dot-separated base64url segments)","Re-run `cloudflared access login` to obtain a fresh, correctly formatted token","Strip quotes/whitespace when reading the token from a file or env var"],"exampleFix":"# before\ncloudflared tail --token \"$CF_API_TOKEN\" <tunnel-id>\n# after\ncloudflared tail --token \"$ACCESS_MANAGEMENT_JWT\" <tunnel-id>","handlingStrategy":"validation","validationCode":"parts := strings.Split(strings.TrimSpace(token), \".\")\nif len(parts) != 3 {\n\treturn errors.New(\"token is not a JWT; expected an Access management token\")\n}","typeGuard":"func looksLikeJWT(s string) bool {\n\ts = strings.TrimSpace(s)\n\tparts := strings.Split(s, \".\")\n\treturn len(parts) == 3 && len(s) > 40\n}","tryCatchPattern":"if _, err := management.ParseToken(token); err != nil {\n\treturn fmt.Errorf(\"--token is not a valid management JWT: %w\", err)\n}","preventionTips":["Do not confuse Cloudflare API tokens or tunnel tokens with Access JWTs","Trim quotes/whitespace when loading tokens from files or env","Re-authenticate with `cloudflared access login` when in doubt"],"tags":["cli","auth","jwt","token"],"backgroundTag":"jwt-token-expired","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}