What causes "Error validating origin URL" in cloudflare/cloudflared?

Use a fully qualified origin URL: `--url http://localhost:8080`.

Error validating origin URL

Error message

Error validating origin URL

What it means

parseSingleOriginService validates the --url flag value with config.ValidateUrl when building a single-origin ingress from CLI flags. Any validation failure (unparseable URL, disallowed scheme, missing host) is wrapped as 'Error validating origin URL'. It guards that the origin cloudflared proxies to is a usable URL.

Source

Thrown at ingress/ingress.go:173

	ingress := Ingress{
		Rules:    defaultRule,
		Defaults: defaults,
	}
	return ingress
}

// Get a single origin service from the CLI/config.
func parseSingleOriginService(c *cli.Context, allowURLFromArgs bool) (OriginService, error) {
	if c.IsSet(HelloWorldFlag) {
		return new(helloWorld), nil
	}
	if c.IsSet(config.BastionFlag) {
		return newBastionService(), nil
	}
	if c.IsSet("url") {
		originURL, err := config.ValidateUrl(c, allowURLFromArgs)
		if err != nil {
			return nil, errors.Wrap(err, "Error validating origin URL")
		}
		if isHTTPService(originURL) {
			return &httpService{
				url: originURL,
			}, nil
		}
		return newTCPOverWSService(originURL), nil
	}
	if c.IsSet("unix-socket") {
		path, err := config.ValidateUnixSocket(c)
		if err != nil {
			return nil, errors.Wrap(err, "Error validating --unix-socket")
		}
		return &unixSocketPath{path: path, scheme: "http"}, nil
	}
	return nil, ErrNoIngressRulesCLI
}

View on GitHub (pinned to 2253eeeb25)

Solutions

Use a fully qualified origin URL: `--url http://localhost:8080`.
Check the scheme is supported (http, https, or tcp-style per the service type).
Verify host/port are correct and the service is formatted as a valid URL.
If pointing at a unix socket, use --unix-socket instead of a file:// URL.

Example fix

// before
cloudflared tunnel --url localhost:8080
// after
cloudflared tunnel --url http://localhost:8080

Defensive patterns

Strategy: validation

Validate before calling

// Go: validate the origin URL before passing --url
u, err := url.Parse(originArg)
valid := err == nil &&
	(u.Scheme == "http" || u.Scheme == "https") &&
	u.Host != ""
if !valid {
	// fix the argument before invoking cloudflared
}

Prevention

Always include an explicit scheme: http:// or https://.
Never embed credentials or paths in --url; keep it scheme://host:port.
Use --unix-socket for socket-based origins instead of a file:// URL.
Test the URL with a curl to the origin before wiring it into cloudflared.

When it happens

Trigger: Running cloudflared with `--url <value>` (e.g. `cloudflared tunnel --url ...` or `cloudflared tunnel route ...`) where the value is not a valid URL: missing scheme, typo like 'http:/localhost:8080', unsupported scheme (ftp://), or an unparseable host/port combination.

Common situations: Forgetting the scheme (localhost:8080 may fail depending on validation), typos in the URL, using --url together with a config-file ingress incorrectly, or service URLs with credentials/special characters that break parsing.

Understand the failure class

Background: "Invalid URL" / "URL cannot be empty": fix the malformed or missing URL behind request-construction failures — this error's family across 50 libraries.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/ddac678c0dd8eae7. Report an issue: GitHub.