What causes "error on request %d: %s" in cloudflare/cloudflared?

Retry the transfer/login after a short wait; the loop can be re-run.

error on request %d: %s

Error message

error on request %d: %s

What it means

During the Access token transfer polling loop, the server returned an HTTP status >= 500. poll copies the response body into the error message so the operator can see what the remote transfer service said. This is an upstream/server-side failure, not a client bug.

Source

Thrown at token/transfer.go:154

	if err != nil {
		return nil, "", err
	}
	req.Header.Set(userAgentHeader, userAgent)
	resp, err := client.Do(req) // nolint: gosec
	if err != nil {
		return nil, "", err
	}
	defer func() { _ = resp.Body.Close() }()

	// ignore everything other than server errors as the resource
	// may not exist until the user does the interaction
	if resp.StatusCode >= 500 {
		buf := new(bytes.Buffer)
		if _, err := io.Copy(buf, resp.Body); err != nil {
			return nil, "", err
		}

		return nil, "", fmt.Errorf("error on request %d: %s", resp.StatusCode, buf.String())
	}
	if resp.StatusCode != 200 {
		log.Info().Msg("Waiting for login...")
		return nil, "", nil
	}

	buf := new(bytes.Buffer)
	if _, err := io.Copy(buf, resp.Body); err != nil {
		return nil, "", err
	}
	return buf.Bytes(), resp.Header.Get("service-public-key"), nil
}

View on GitHub (pinned to 2253eeeb25)

Solutions

Retry the transfer/login after a short wait; the loop can be re-run.
Check the Cloudflare status page for Access incidents.
Inspect the body in the error message for the server's diagnostic.
Verify no corporate proxy is intercepting and failing the request (502/504).

Defensive patterns

Strategy: retry

Try / catch

token, err := transferRequest(...)
if err != nil {
    var retriable = strings.Contains(err.Error(), "error on request 5")
    if retriable {
        time.Sleep(backoff); retry()
    }
}

Prevention

Check the Cloudflare status page before assuming a client bug
Use exponential backoff on 5xx responses
Bypass corporate proxies for cloudflared endpoints when possible

When it happens

Trigger: transferRequest's poll receives a response with StatusCode 500-599 from the Cloudflare Access token transfer endpoint.

Common situations: Cloudflare Access service incident or degraded edge; proxy/intermediary (corporate proxy) returning 502/504; rate limiting or internal server error while awaiting login completion.

Understand the failure class

Background: "API error: {status}" and "HTTP 401/403/404/429/5xx" errors: non-2xx HTTP responses explained — this error's family across 27 libraries.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/b077f682ccff732f. Report an issue: GitHub.