cloudflare/cloudflared · error

Could not create access request

Error message

Could not create access request

What it means

isTokenValid (part of token verification at the edge) builds an HTTP request via carrier.BuildAccessRequest using the provided StartOptions. "Could not create access request" wraps any failure there — typically the options contain an unparseable origin URL or the request cannot be constructed. The error occurs before the request is sent, so it is local, not an edge rejection.

Source

Thrown at cmd/cloudflared/access/cmd.go:579

	if err := token.RemoveTokenIfExists(appInfo); err != nil {
		return err
	}

	if valid, err := isTokenValid(options, log); err != nil {
		return err
	} else if !valid {
		return errors.New("failed to verify token")
	}

	return nil
}

// isTokenValid makes a request to the origin and returns true if the response was not a 302.
func isTokenValid(options *carrier.StartOptions, log *zerolog.Logger) (bool, error) {
	req, err := carrier.BuildAccessRequest(options, log)
	if err != nil {
		return false, errors.Wrap(err, "Could not create access request")
	}
	req.Header.Set("User-Agent", userAgent)

	query := req.URL.Query()
	query.Set("cloudflared_token_check", "true")
	req.URL.RawQuery = query.Encode()

	// Do not follow redirects
	client := &http.Client{
		CheckRedirect: func(req *http.Request, via []*http.Request) error {
			return http.ErrUseLastResponse
		},
		Timeout: time.Second * 5,
	}
	resp, err := client.Do(req)
	if err != nil {
		return false, err
	}

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Re-authenticate with `cloudflared access login <app-url>` to regenerate a valid token/config.
2. Check that the origin/app URL in options is a full, well-formed URL (scheme + host).
3. Log the wrapped error with %+v to see BuildAccessRequest's underlying message.
4. If constructing StartOptions in code, validate url.Parse(OriginURL) succeeds before calling.

Example fix

// before
opts := &carrier.StartOptions{OriginURL: "myapp.example.com"}
// after
opts := &carrier.StartOptions{OriginURL: "https://myapp.example.com"}

if u, err := url.Parse(options.OriginURL); err != nil || u.Scheme == "" || u.Host == "" {
	return fmt.Errorf("OriginURL must be an absolute URL, got %q", options.OriginURL)
}

valid, err := isTokenValid(opts, log)
if err != nil {
	log.Err(err).Msgf("token check failed: %+v", err)
	return false, err
}

When it happens

Trigger: Calling verifyTokenAtEdge/isTokenValid with StartOptions whose OriginURL (or AuthDomain/ServiceToken fields) cannot be turned into a valid http.Request — e.g., empty or malformed origin URL.

Common situations: Stale or hand-edited access token/config files referencing a deleted app; passing --app-url values without scheme; programmatic use of carrier.StartOptions with unset OriginURL.

Understand the failure class

Background: "API request failed": what wrapped HTTP errors from external APIs mean and how to find the real cause — this error's family across 29 libraries.

Related errors

• not a valid url
• not a valid host
• no input provided
• failed to parse as URL: %w
• error validating origin URL

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/15a47cccbf9c2f82. Report an issue: GitHub.