cloudflare/cloudflared · error

empty application token

Error message

empty application token

What it means

The access login command retrieves an Access application token via token.GetAppTokenIfExists; if the token comes back empty it treats this as a hard failure with this error. It means Cloudflare Access did not issue a usable token for the given application URL even though no explicit error was raised.

Source

Thrown at cmd/cloudflared/access/cmd.go:276

	}

	appInfo, err := token.GetAppInfo(appURL)
	if err != nil {
		return err
	}

	if err := verifyTokenAtEdge(appURL, appInfo, c, log); err != nil {
		log.Err(err).Msg("Could not verify token")
		return err
	}

	cfdToken, err := token.GetAppTokenIfExists(appInfo)
	if err != nil {
		fmt.Fprintln(os.Stderr, "Unable to find token for provided application.")
		return err
	} else if cfdToken == "" {
		fmt.Fprintln(os.Stderr, "token for provided application was empty.")
		return errors.New("empty application token")
	}

	if c.Bool(loginQuietFlag) {
		return nil
	}

	// Chatty by default for backward compat. The new --app flag
	// is an implicit opt-out of the backwards-compatible chatty output.
	if c.Bool("no-verbose") || c.IsSet(appURLFlag) {
		fmt.Fprint(os.Stdout, cfdToken)
	} else {
		fmt.Fprintf(os.Stdout, "Successfully fetched your token:\n\n%s\n\n", cfdToken)
	}

	return nil
}

// curl provides a wrapper around curl, passing Access JWT along in request

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Re-run `cloudflared access login <url>` and complete the browser authentication fully
2. Verify your identity is permitted by the application's Access policy
3. Confirm the URL points to an application protected by Cloudflare Access
4. Clear cloudflared's local token store and retry to avoid stale empty entries

Example fix

// before
# failing: cloudflared access login https://app.example.com
// after
# ensure policy grants your email, then:
# cloudflared access login https://app.example.com
# or generate a service token and use it:
# export TUNNEL_SERVICE_TOKEN_ID=...; export TUNNEL_SERVICE_TOKEN_SECRET=...

err := loginApp(ctx, appURL)
if err != nil && strings.Contains(err.Error(), "empty application token") {
    // prompt re-authentication or fall back to service tokens
    return fmt.Errorf("no Access token issued for %s; check policies: %w", appURL, err)
}

When it happens

Trigger: Running `cloudflared access login <app-url>` when the browser/device flow returns no token: the user is not authorized for the application, the app URL is wrong, or the local token store returned an empty value.

Common situations: Access policies not granting the current identity; expired or cleared browser session during login; mistyped application URL pointing at a non-Access route; corporate SSO flow silently failing.

Related errors

• unable to acquire management token for requested tunnel id:
• failed to determine if token is FED: %w
• incorrect args
• not a valid url
• not a valid host

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/11224ca01a4965dc. Report an issue: GitHub.