cloudflare/cloudflared · error
Cannot parse tag value %s
Error message
Cannot parse tag value %s
What it means
NewTagSliceFromCLI converts --tag key=value CLI flags into pogs.Tag values. NewTagFromCLI returns ok=false for any entry that isn't a single key=value pair (e.g. missing '=', or multiple '=' segments producing wrong shape), so the whole tag slice fails with this parse error.
Source
Thrown at cmd/cloudflared/tunnel/tag.go:28
// Restrict key names to characters allowed in an HTTP header name.
// Restrict key values to printable characters (what is recognised as data in an HTTP header value).
var tagRegexp = regexp.MustCompile("^([a-zA-Z0-9!#$%&'*+\\-.^_`|~]+)=([[:print:]]+)$")
func NewTagFromCLI(compoundTag string) (pogs.Tag, bool) {
matches := tagRegexp.FindStringSubmatch(compoundTag)
if len(matches) == 0 {
return pogs.Tag{}, false
}
return pogs.Tag{Name: matches[1], Value: matches[2]}, true
}
func NewTagSliceFromCLI(tags []string) ([]pogs.Tag, error) {
var tagSlice []pogs.Tag
for _, compoundTag := range tags {
if tag, ok := NewTagFromCLI(compoundTag); ok {
tagSlice = append(tagSlice, tag)
} else {
return nil, fmt.Errorf("Cannot parse tag value %s", compoundTag)
}
}
return tagSlice, nil
}
View on GitHub (pinned to 2253eeeb25)
Solutions
- Use the exact key=value form: --tag team=backend (repeat the flag for each tag).
- Quote values containing spaces: --tag "env=prod us-east".
- Check the config file's tag array entries for missing or extra '=' separators.
Example fix
// before cloudflared tunnel run --tag team backend // after cloudflared tunnel run --tag team=backend
Defensive patterns
Strategy: validation
Validate before calling
for _, t := range tagFlags {
parts := strings.SplitN(t, "=", 2)
if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
return fmt.Errorf("tag %q must be key=value", t)
}
} Prevention
- Always write tags as --tag key=value with a single '='.
- Quote values containing spaces.
- Validate tag entries in config files before launching cloudflared.
When it happens
Trigger: Passing a malformed --tag flag value: no '=' separator (e.g. --tag foo), an empty string, or a value shape NewTagFromCLI rejects; also triggered programmatically via prepareTunnelConfig from any config file with an invalid tag entry.
Common situations: See trigger scenarios.
Understand the failure class
Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.
Related errors
AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06).
Data as JSON: /api/errors/93228f6c8ef34880.
Report an issue: GitHub.