{"record":{"id":"d8b603a40e3d84cc","repo":"cloudflare/cloudflared","slug":"failed-to-generate-org-token-file-path","errorCode":null,"errorMessage":"failed to generate org token file path","messagePattern":"failed to generate org token file path","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"token/token.go","lineNumber":363,"sourceCode":"\n\tappTokenLock, err := acquireLockFile(appTokenPath, log)\n\tif err != nil {\n\t\treturn \"\", errors.Wrap(err, \"failed to acquire app token lock\")\n\t}\n\tdefer appTokenLock.release()\n\n\t// check to see if another process has gotten a token while we waited for the lock\n\tif token, err := GetAppTokenIfExists(appInfo); token != \"\" && err == nil {\n\t\treturn token, nil\n\t}\n\n\t// If an app token couldn't be found on disk, check for an org token and attempt to exchange it for an app token.\n\tvar orgTokenPath string\n\torgToken, orgTokenErr := GetOrgTokenIfExists(appInfo.AuthDomain)\n\tif orgTokenErr != nil {\n\t\torgTokenPath, err = generateOrgTokenFilePathFromURL(appInfo.AuthDomain)\n\t\tif err != nil {\n\t\t\treturn \"\", errors.Wrap(err, \"failed to generate org token file path\")\n\t\t}\n\n\t\torgTokenLock, orgLockErr := acquireLockFile(orgTokenPath, log)\n\t\tif orgLockErr != nil {\n\t\t\treturn \"\", errors.Wrap(orgLockErr, \"failed to acquire org token lock\")\n\t\t}\n\t\tdefer orgTokenLock.release()\n\t\t// check if an org token has been created since the lock was acquired\n\t\torgToken, orgTokenErr = GetOrgTokenIfExists(appInfo.AuthDomain)\n\t}\n\tif orgTokenErr == nil {\n\t\tif appToken, exchangeErr := exchangeOrgToken(appURL, orgToken); exchangeErr != nil {\n\t\t\tlog.Debug().Msgf(\"failed to exchange org token for app token: %s\", exchangeErr)\n\t\t} else {\n\t\t\t// generate app path\n\t\t\tif err := os.WriteFile(appTokenPath, []byte(appToken), 0600); err != nil { // nolint: gosec\n\t\t\t\treturn \"\", errors.Wrap(err, \"failed to write app token to disk\")\n\t\t\t}","sourceCodeStart":345,"sourceCodeEnd":381,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/token/token.go#L345-L381","documentation":"getToken wraps this error when generateOrgTokenFilePathFromURL fails while building the cache path for the org token. This only happens when no org token exists on disk yet (GetOrgTokenIfExists errored) and the code needs a path to store one. A failure here means the org-token exchange flow cannot proceed on disk.","triggerScenarios":"FetchToken -> getToken where GetOrgTokenIfExists(appInfo.AuthDomain) returns an error AND generateOrgTokenFilePathFromURL(appInfo.AuthDomain) also fails — the auth domain URL cannot be converted to a valid file path (invalid characters, unparsable URL).","commonSituations":"AuthDomain configured as a malformed URL (missing scheme, stray characters) in tunnel configuration; environment variables supplying an invalid auth domain; changes to team name / auth domain format that path generation does not accept.","solutions":["Inspect the wrapped cause to identify which part of AuthDomain failed path conversion","Verify the auth domain in the tunnel config is a valid hostname URL (e.g. https://<team>.cloudflareaccess.com) with no trailing junk","Fix any environment/config source supplying the auth domain and restart cloudflared","Clear stale token files and retry: rm -f ~/.cloudflared/org-token*"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// validate the auth domain parses as a URL before token operations\nu, err := url.Parse(authDomain)\nif err != nil || u.Host == \"\" {\n\treturn fmt.Errorf(\"invalid auth domain %q: %w\", authDomain, err)\n}","typeGuard":null,"tryCatchPattern":"token, err := FetchToken(...)\nif err != nil && strings.Contains(err.Error(), \"failed to generate org token file path\") {\n\tlog.Error().Err(err).Str(\"authDomain\", authDomain).Msg(\"auth domain cannot be converted to token path; check config\")\n}","preventionTips":["Store the auth domain as a full https:// URL (e.g. https://team.cloudflareaccess.com)","Strip whitespace when reading authDomain from env/config","Re-verify auth-domain config after team-name changes","Test `cloudflared access login` after any domain migration"],"tags":["filesystem","token","path","url"],"backgroundTag":"invalid-url-format","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}