cloudflare/cloudflared · warning

close token file: %w

Error message

close token file: %w

What it means

After successfully creating the token file handle, createTokenFile releases it with windows.CloseHandle. If the Win32 CloseHandle call fails, cloudflared wraps the error with this message. This is a rare OS-level failure indicating the handle was invalid or already closed.

Source

Thrown at cmd/cloudflared/windows_service.go:171

		pathRaw,
		windows.GENERIC_WRITE,
		0,
		&windows.SecurityAttributes{
			Length:             uint32(unsafe.Sizeof(windows.SecurityAttributes{})),
			SecurityDescriptor: sd,
			InheritHandle:      0,
		},
		windows.CREATE_ALWAYS, // Will truncate the file if it exists
		windows.FILE_ATTRIBUTE_NORMAL,
		0,
	)

	if err != nil {
		return fmt.Errorf("create token file: %w", err)
	}

	if err := windows.CloseHandle(f); err != nil {
		return fmt.Errorf("close token file: %w", err)
	}

	// As with os.CreateFile / os.OpenFile on Unix, if the file already exists
	// windows.CreateFile will not update the permission information, so we do
	// that explicitly after creating the file.

	owner, _, err := sd.Owner()
	if err != nil {
		return fmt.Errorf("get token file owner: %w", err)
	}

	dacl, _, err := sd.DACL()
	if err != nil {
		return fmt.Errorf("get token file DACL: %w", err)
	}

	// Bitmask indicating which security info we want to set on the file:
	//

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Retry the service install — a transient handle issue usually resolves on a fresh run
2. Reboot the machine if handle exhaustion is suspected (check Process Explorer handle counts)
3. Verify no modified builds of cloudflared close the handle twice; rebuild from the official release
4. If it reproduces consistently, capture the wrapped Win32 error and file a cloudflared issue

if err := createTokenFile(path); err != nil {
	if strings.Contains(err.Error(), "close token file") {
		time.Sleep(500 * time.Millisecond)
		return createTokenFile(path) // transient handle issues usually clear
	}
	return err
}

When it happens

Trigger: windows.CloseHandle(f) returns an error after a successful windows.CreateFile in createTokenFile — the handle is invalid, duplicated, or the process is being torn down.

Common situations: Memory corruption or handle-table exhaustion on the host; the handle was already closed elsewhere (a code bug); running under a constrained sandbox/Job object that invalidates handles.

Related errors

• create token file: %w
• cloudflared service is already installed at ${service}; if y
• Error during update : %s;
• create token security descriptor: %w
• convert path to UTF-16: %w

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/6d7e72bc52d6a587. Report an issue: GitHub.