cloudflare/cloudflared · error

cached token audience does not include expected application

Error message

cached token audience does not include expected application audience %q

What it means

The cached Access token's aud (audience) claim does not contain the audience of the application being accessed (appInfo.AppAUD). cloudflared rejects tokens issued for a different Access application rather than replaying them, and returns this error after (best-effort) removing the stale cache entry. The user must obtain a fresh token for the correct application.

Source

Thrown at token/token.go:630

	token, err := getTokenIfExists(path)
	if err != nil {
		return "", err
	}
	var payload jwtPayload
	err = json.Unmarshal(token.UnsafePayloadWithoutVerification(), &payload)
	if err != nil {
		return "", err
	}

	if payload.isExpired() {
		err := os.Remove(path)
		return "", err
	}
	if !slices.Contains(payload.Aud, appInfo.AppAUD) {
		if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
			return "", fmt.Errorf("failed to remove cached token with unexpected audience: %w", err)
		}
		return "", fmt.Errorf("cached token audience does not include expected application audience %q", appInfo.AppAUD)
	}

	return token.CompactSerialize()
}

// GetTokenIfExists will return the token from local storage if it exists and not expired
func getTokenIfExists(path string) (*jose.JSONWebSignature, error) {
	content, err := os.ReadFile(path) // nolint: gosec
	if err != nil {
		return nil, err
	}
	token, err := jose.ParseSigned(string(content), signatureAlgs)
	if err != nil {
		return nil, err
	}
	return token, nil
}

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Run `cloudflared access login <url>` again to mint a token for the correct application.
2. Verify the configured AppAUD matches the Access application in the Cloudflare dashboard.
3. Clear the token cache directory so the stale token is not re-read.

Example fix

// before
appInfo := globalAppInfo // AppAUD from a previous/different app
// after
cloudflared access login https://app.example.com // refresh token for the correct appAUD

token, err := token.GetAppTokenIfExists(appInfo)
if err != nil {
    if strings.Contains(err.Error(), "audience does not include") {
        token, err = login(appInfo) // fallback: fetch a fresh token
    }
    if err != nil { return err }
}

When it happens

Trigger: Calling GetAppTokenIfExists (via login, curl, or generateToken) when the token cached on disk was minted for a different Cloudflare Access application (its Aud list lacks appInfo.AppAUD).

Common situations: User logged into app A earlier, then runs cloudflared access curl against app B which shares the same cache location; AppAUD changed server-side after token issuance; misconfigured appAUD flag in the local config.

Related errors

• failed to remove cached token with unexpected audience: %w
• invalid token
• aud array contains non-string elements
• aud field is not a string or an array of strings
• metadata JWT aud is empty

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/66f394ee399277b6. Report an issue: GitHub.