{"record":{"id":"c2cd61c5e8c20713","repo":"cloudflare/cloudflared","slug":"failed-to-verify-token","errorCode":null,"errorMessage":"failed to verify token","messagePattern":"failed to verify token","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/access/cmd.go","lineNumber":569,"sourceCode":"\tif c.IsSet(sshTokenSecretFlag) {\n\t\theaders.Add(cfAccessClientSecretHeader, c.String(sshTokenSecretFlag))\n\t}\n\toptions := &carrier.StartOptions{AppInfo: appInfo, OriginURL: appUrl.String(), Headers: headers, AutoCloseInterstitial: c.Bool(cfdflags.AutoCloseInterstitial), IsFedramp: c.Bool(fedrampFlag)}\n\n\tif valid, err := isTokenValid(options, log); err != nil {\n\t\treturn err\n\t} else if valid {\n\t\treturn nil\n\t}\n\n\tif err := token.RemoveTokenIfExists(appInfo); err != nil {\n\t\treturn err\n\t}\n\n\tif valid, err := isTokenValid(options, log); err != nil {\n\t\treturn err\n\t} else if !valid {\n\t\treturn errors.New(\"failed to verify token\")\n\t}\n\n\treturn nil\n}\n\n// isTokenValid makes a request to the origin and returns true if the response was not a 302.\nfunc isTokenValid(options *carrier.StartOptions, log *zerolog.Logger) (bool, error) {\n\treq, err := carrier.BuildAccessRequest(options, log)\n\tif err != nil {\n\t\treturn false, errors.Wrap(err, \"Could not create access request\")\n\t}\n\treq.Header.Set(\"User-Agent\", userAgent)\n\n\tquery := req.URL.Query()\n\tquery.Set(\"cloudflared_token_check\", \"true\")\n\treq.URL.RawQuery = query.Encode()\n\n\t// Do not follow redirects","sourceCodeStart":551,"sourceCodeEnd":587,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/access/cmd.go#L551-L587","documentation":"cloudflared access verifies that the Access token you are using is actually accepted by Cloudflare's edge before proceeding. verifyTokenAtEdge calls isTokenValid, which makes a request through the Access application and checks the response; if the response indicates the token was rejected (not a valid/authenticated response), this error is thrown. It means the token exists but the edge did not accept it as valid for this application.","triggerScenarios":"Running `cloudflared access login` or `cloudflared access curl` with a token that has expired, was revoked, was issued for a different Access application/audience (aud mismatch), or was corrupted/truncated when passed via --token or CF_ACCESS_TOKEN.","commonSituations":"CI pipelines reusing a long-expired service token; copying only part of the token from the browser cookie; token generated for app A used against app B; IdP session revoked after token issuance.","solutions":["Re-authenticate to get a fresh token: run `cloudflared access login <url>` again or re-export CF_ACCESS_TOKEN.","Verify the token matches the application you are accessing (correct aud/AUD tag; use `cloudflared access curl` with the exact app URL).","If using a service token, confirm it is still active in Zero Trust (Access > Service Auth) and bound to the right application policy.","Check local clock skew; severely skewed clocks can invalidate token validation."],"exampleFix":"// before\nexport CF_ACCESS_TOKEN=<old-expired-token>\ncloudflared access curl https://app.example.com\n// after\ncloudflared access login https://app.example.com  # obtain fresh token\ncloudflared access curl https://app.example.com","handlingStrategy":"validation","validationCode":"if token == \"\" || len(token) < 100 {\n    return errors.New(\"access token missing or looks truncated; re-run `cloudflared access login <url>`\")\n}","typeGuard":null,"tryCatchPattern":"if _, err := verifyTokenAtEdge(options, log); err != nil {\n    if strings.Contains(err.Error(), \"failed to verify token\") {\n        // trigger re-authentication flow before surfacing to user\n        return fmt.Errorf(\"token rejected by edge; re-authenticate: %w\", err)\n    }\n    return err\n}","preventionTips":["Always obtain tokens via `cloudflared access login` for the exact app URL you will access.","Do not cache tokens across sessions beyond their lifetime; refresh before CI runs.","Keep service tokens active in Zero Trust Service Auth and scoped to the right application.","Pass the full token — cookies/token values are long and often truncated by copy-paste or line-wrapping."],"tags":["access","authentication","token","cloudflare"],"backgroundTag":"authentication-required","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}