cloudflare/cloudflared · error

access.TeamName cannot be blank when access.audTags are pres

Error message

access.TeamName cannot be blank when access.audTags are present

What it means

This validation error is raised when an ingress rule's access configuration specifies audTags but leaves access.teamName empty. Cloudflare Access policy matching requires both the team (account) name and audience tags, so a partial Access config is rejected.

Source

Thrown at ingress/ingress.go:239

// code for all incoming requests.
func GetDefaultIngressRules(log *zerolog.Logger) []Rule {
	noRulesService := newDefaultStatusCode(log)
	return []Rule{
		{
			Service: &noRulesService,
		},
	}
}

func validateAccessConfiguration(cfg *config.AccessConfig) error {
	if !cfg.Required {
		return nil
	}

	// we allow for an initial setup where user can force Access but not configure the rest of the keys.
	// however, if the user specified audTags but forgot teamName, we should alert it.
	if cfg.TeamName == "" && len(cfg.AudTag) > 0 {
		return errors.New("access.TeamName cannot be blank when access.audTags are present")
	}

	return nil
}

func validateIngress(ingress []config.UnvalidatedIngressRule, defaults OriginRequestConfig) (Ingress, error) {
	rules := make([]Rule, len(ingress))
	for i, r := range ingress {
		cfg := setConfig(defaults, r.OriginRequest)
		var service OriginService

		if prefix := "unix:"; strings.HasPrefix(r.Service, prefix) {
			// No validation necessary for unix socket filepath services
			path := strings.TrimPrefix(r.Service, prefix)
			service = &unixSocketPath{path: path, scheme: "http"}
		} else if prefix := "unix+tls:"; strings.HasPrefix(r.Service, prefix) {
			path := strings.TrimPrefix(r.Service, prefix)
			service = &unixSocketPath{path: path, scheme: "https"}

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Add the teamName field to the access block with your Cloudflare Zero Trust team name
2. If Access is not intended, remove the audTags entries
3. Run 'cloudflared tunnel ingress validate' after editing

Example fix

// before
access:
  audTag:
    - org.example
// after
access:
  teamName: my-team
  audTag:
    - org.example

func accessConfigValid(c config.AccessConfig) bool { return c.TeamName != "" || len(c.AudTag) == 0 }

When it happens

Trigger: validateAccessConfiguration (called by validateIngress) sees cfg.AudTag non-empty while cfg.TeamName == "" in an ingress rule's access block.

Common situations: Users enabling Access on a rule by listing audTags but forgetting the required teamName key (their Cloudflare Zero Trust team name).

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• not a valid host
• no input provided
• The last ingress rule must match all URLs (i.e. it should no
• Hostname patterns can have at most one wildcard character ("
• Hostname cannot contain a port

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/a7cc8dd3370f80d2. Report an issue: GitHub.