cloudflare/cloudflared · error

create token file: %w

Error message

create token file: %w

What it means

createTokenFile calls the Win32 API windows.CreateFile with GENERIC_WRITE, CREATE_ALWAYS and FILE_ATTRIBUTE_NORMAL to create (or truncate) the service access-token file. If the underlying Win32 CreateFile call fails, cloudflared wraps the Win32 error with this message. Because CREATE_ALWAYS is used, the token file is recreated on every service install.

Source

Thrown at cmd/cloudflared/windows_service.go:167

		return fmt.Errorf("convert path to UTF-16: %w", err)
	}

	f, err := windows.CreateFile(
		pathRaw,
		windows.GENERIC_WRITE,
		0,
		&windows.SecurityAttributes{
			Length:             uint32(unsafe.Sizeof(windows.SecurityAttributes{})),
			SecurityDescriptor: sd,
			InheritHandle:      0,
		},
		windows.CREATE_ALWAYS, // Will truncate the file if it exists
		windows.FILE_ATTRIBUTE_NORMAL,
		0,
	)

	if err != nil {
		return fmt.Errorf("create token file: %w", err)
	}

	if err := windows.CloseHandle(f); err != nil {
		return fmt.Errorf("close token file: %w", err)
	}

	// As with os.CreateFile / os.OpenFile on Unix, if the file already exists
	// windows.CreateFile will not update the permission information, so we do
	// that explicitly after creating the file.

	owner, _, err := sd.Owner()
	if err != nil {
		return fmt.Errorf("get token file owner: %w", err)
	}

	dacl, _, err := sd.DACL()
	if err != nil {
		return fmt.Errorf("get token file DACL: %w", err)

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Verify the parent directory exists: if PROGRAMDATA\Cloudflare was removed, reinstall the service after recreating it
2. Check the file is not locked/open by another process (Resource Monitor or handle.exe)
3. Run the install from an elevated prompt so Administrators can write under %PROGRAMDATA%
4. Inspect the wrapped Win32 error code in the message (e.g. Access is denied, The system cannot find the path specified) and address it specifically

Example fix

// before
f, err := windows.CreateFile(pathRaw, windows.GENERIC_WRITE, 0, nil, windows.CREATE_ALWAYS, windows.FILE_ATTRIBUTE_NORMAL, 0)
if err != nil {
	return fmt.Errorf("create token file: %w", err)
}
// after
if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
	return fmt.Errorf("ensure config dir: %w", err)
}
f, err := windows.CreateFile(pathRaw, windows.GENERIC_WRITE, 0, nil, windows.CREATE_ALWAYS, windows.FILE_ATTRIBUTE_NORMAL, 0)
if err != nil {
	return fmt.Errorf("create token file: %w", err)
}

// PowerShell: verify target dir exists and is writable before install
$dir = Join-Path $env:PROGRAMDATA 'Cloudflare'
if (-Not (Test-Path $dir)) { New-Item -ItemType Directory -Path $dir | Out-Null }
try { [IO.File]::OpenWrite((Join-Path $dir 'token')).Close() } catch { Write-Error "Cannot write to $dir: $_"; exit 1 }

if err := createTokenFile(path); err != nil {
	if strings.Contains(err.Error(), "create token file") {
		_ = os.MkdirAll(filepath.Dir(path), 0o755) // ensure parent dir, then retry once
		if retryErr := createTokenFile(path); retryErr != nil { return retryErr }
		return nil
	}
	return err
}

When it happens

Trigger: The Win32 CreateFile call in createTokenFile returns a non-nil error (e.g. invalid handle parameters, path problems, sharing violations).

Common situations: The target directory does not exist or the path is malformed; another process holds the file open with a conflicting share mode; disk-full or read-only volume; overly restrictive ACLs on the parent directory.

Understand the failure class

Background: "open() failed", "failed to open file", "cannot create file" — what a file open error means and how to fix it — this error's family across 42 libraries.

Related errors

• close token file: %w
• cloudflared service is already installed at ${service}; if y
• Error during update : %s;
• create token security descriptor: %w
• convert path to UTF-16: %w

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/e943dbca11a492f3. Report an issue: GitHub.