cloudflare/cloudflared · error

failed to create app token request

Error message

failed to create app token request

What it means

This error wraps a failure from http.NewRequest("HEAD", appURL.String(), nil) inside exchangeOrgToken, which builds the request used to exchange an org token for an app token. Like all http.NewRequest failures it indicates malformed request input — almost always an unparseable URL. The wrapped err identifies the exact parse problem.

Source

Thrown at token/token.go:561

	if len(via) > 0 && strings.Contains(via[len(via)-1].URL.Path, AccessAuthorizedWorkerPath) {
		return http.ErrUseLastResponse
	}
	return nil
}

// exchangeOrgToken attaches an org token to a request to the appURL and returns an app token. This uses the Access SSO
// flow to automatically generate and return an app token without the login page.
func exchangeOrgToken(appURL *url.URL, orgToken string) (string, error) {
	client := &http.Client{
		CheckRedirect: func(req *http.Request, via []*http.Request) error {
			return handleRedirects(req, via, orgToken)
		},
		Timeout: time.Second * 7,
	}

	appTokenRequest, err := http.NewRequest("HEAD", appURL.String(), nil)
	if err != nil {
		return "", errors.Wrap(err, "failed to create app token request")
	}
	appTokenRequest.Header.Add(userAgentHeader, userAgent)
	resp, err := client.Do(appTokenRequest) // nolint: gosec
	if err != nil {
		return "", errors.Wrap(err, "failed to get app token")
	}
	_ = resp.Body.Close()
	var appToken string
	for _, c := range resp.Cookies() {
		//if Org token revoked on exchange, getTokensFromEdge instead
		validAppToken := c.Name == tokenCookie && time.Now().Before(c.Expires)
		if validAppToken {
			appToken = c.Value
			break
		}
	}

	if len(appToken) > 0 {

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Delete the cached org token file and re-authenticate so a fresh, valid edge response regenerates appURL
2. Verify the Access application's domain configuration in the Cloudflare Zero Trust dashboard is a well-formed https URL
3. Log/inspect appURL.String() before the request to spot malformed values
4. Re-run the login flow (cloudflared access login) to refresh connection metadata

if u, err := url.Parse(appURL.String()); err != nil || u.Scheme == "" || u.Host == "" {
	// corrupted token metadata: delete cached org token and re-authenticate
	os.Remove(orgTokenPath)
}

appToken, err := getToken(ctx, log)
if err != nil && strings.Contains(err.Error(), "failed to create app token request") {
	// discard cached org token and re-run the full login flow
}

When it happens

Trigger: exchangeOrgToken (via getToken) constructs appURL and http.NewRequest fails — the org-token response's aud/APP connection info yielded a URL that fails parsing (missing/invalid scheme, invalid characters).

Common situations: Corrupted or unexpected edge token response producing a bad app URL; malformed configuration of the Access application domain; manual tampering with the token file containing a broken URL field.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• failed to create app info request
• not a valid host
• no input provided
• failed to parse Host
• invalid Host provided

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/9250d192272941c1. Report an issue: GitHub.