{"record":{"id":"bfd2aeb5dad871db","repo":"cloudflare/cloudflared","slug":"create-tunnel-api-call-failed","errorCode":null,"errorMessage":"Create Tunnel API call failed","messagePattern":"Create Tunnel API call failed","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/tunnel/subcommand_context.go","lineNumber":151,"sourceCode":"\tif secret == \"\" {\n\t\ttunnelSecret, err = generateTunnelSecret()\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"couldn't generate the secret for your new tunnel\")\n\t\t}\n\t} else {\n\t\tdecodedSecret, err := base64.StdEncoding.DecodeString(secret)\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"Couldn't decode tunnel secret from base64\")\n\t\t}\n\t\ttunnelSecret = decodedSecret\n\t\tif len(tunnelSecret) < 32 {\n\t\t\treturn nil, errors.New(\"Decoded tunnel secret must be at least 32 bytes long\")\n\t\t}\n\t}\n\n\ttunnel, err := client.CreateTunnel(name, tunnelSecret)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"Create Tunnel API call failed\")\n\t}\n\n\tcredential, err := sc.credential()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\ttunnelCredentials := connection.Credentials{\n\t\tAccountTag:   credential.AccountID(),\n\t\tTunnelSecret: tunnelSecret,\n\t\tTunnelID:     tunnel.ID,\n\t\tEndpoint:     credential.Endpoint(),\n\t}\n\tusedCertPath := false\n\tif credentialsFilePath == \"\" {\n\t\toriginCertDir := filepath.Dir(credential.CertPath())\n\t\tcredentialsFilePath, err = tunnelFilePath(tunnelCredentials.TunnelID, originCertDir)\n\t\tif err != nil {","sourceCodeStart":133,"sourceCodeEnd":169,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/tunnel/subcommand_context.go#L133-L169","documentation":"The Cloudflare Tunnel API call to create the tunnel (client.CreateTunnel) returned an error. cloudflared wraps it with this message; the underlying error typically carries the Cloudflare API error details (auth, quota, name conflict).","triggerScenarios":"client.CreateTunnel(name, tunnelSecret) fails during `cloudflared tunnel create`, e.g. 4xx/5xx from the Cloudflare API.","commonSituations":"A tunnel with the same name already exists in the account (HTTP 1001/duplicate name); expired or wrong-account origin cert; lacking permission to create tunnels; API outages or rate limits.","solutions":["Read the wrapped API error — for a duplicate name, list with `cloudflared tunnel list` and reuse or delete the existing tunnel","Re-run `cloudflared tunnel login` if the cert is expired or for the wrong account","Check Cloudflare API status and retry on transient 5xx","Verify your account/user has tunnel-creation permissions"],"exampleFix":"// before\ncloudflared tunnel create mytunnel   # already exists\n// after\ncloudflared tunnel list\ncloudflared tunnel delete mytunnel   # or pick a new name\ncloudflared tunnel create mytunnel-2","handlingStrategy":"try-catch","validationCode":"// pre-check for name conflicts\nexisting, _ := client.ListTunnels()\nfor _, t := range existing {\n    if t.Name == name {\n        return fmt.Errorf(\"tunnel %q already exists\", name)\n    }\n}","typeGuard":null,"tryCatchPattern":"if _, err := client.CreateTunnel(name, secret); err != nil {\n    var apiErr *cfapi.APIError\n    if errors.As(err, &apiErr) && apiErr.StatusCode == 409 {\n        // handle duplicate tunnel name\n    }\n    return fmt.Errorf(\"Create Tunnel API call failed: %w\", err)\n}","preventionTips":["Use unique tunnel names or check `tunnel list` first","Keep origin certs fresh (`tunnel login`)","Verify account permissions for tunnel management","Retry on transient 5xx API errors"],"tags":["go","api","cloudflare","http"],"backgroundTag":"api-error-response","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}