cloudflare/cloudflared · error

failed to determine if token is FED: %w

Error message

failed to determine if token is FED: %w

What it means

After obtaining the token, buildURL calls management.ParseToken to decode the JWT and check whether the account is FedRAMP (IsFed) so it can pick the correct management hostname. An unparseable token produces this error.

Source

Thrown at cmd/cloudflared/tail/cmd.go:221

		Sampling: sample,
	}, nil
}

// buildURL will build the management url to contain the required query parameters to authenticate the request.
func buildURL(c *cli.Context, log *zerolog.Logger, res cfapi.ManagementResource) (url.URL, error) {
	var err error

	token := c.String("token")
	if token == "" {
		token, err = cliutil.GetManagementToken(c, log, res, buildInfo)
		if err != nil {
			return url.URL{}, fmt.Errorf("unable to acquire management token for requested tunnel id: %w", err)
		}
	}

	claims, err := management.ParseToken(token)
	if err != nil {
		return url.URL{}, fmt.Errorf("failed to determine if token is FED: %w", err)
	}

	var managementHostname string
	if claims.IsFed() {
		managementHostname = credentials.FedRampHostname
	} else {
		managementHostname = c.String(cfdflags.ManagementHostname)
	}

	query := url.Values{}
	query.Add("access_token", token)
	connector := c.String("connector-id")
	if connector != "" {
		connectorID, err := uuid.Parse(connector)
		if err != nil {
			return url.URL{}, fmt.Errorf("unabled to parse 'connector-id' flag into a valid UUID: %w", err)
		}
		query.Add("connector_id", connectorID.String())

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Verify --token contains a valid Access management JWT (three dot-separated base64url segments)
2. Re-run `cloudflared access login` to obtain a fresh, correctly formatted token
3. Strip quotes/whitespace when reading the token from a file or env var

Example fix

# before
cloudflared tail --token "$CF_API_TOKEN" <tunnel-id>
# after
cloudflared tail --token "$ACCESS_MANAGEMENT_JWT" <tunnel-id>

parts := strings.Split(strings.TrimSpace(token), ".")
if len(parts) != 3 {
	return errors.New("token is not a JWT; expected an Access management token")
}

func looksLikeJWT(s string) bool {
	s = strings.TrimSpace(s)
	parts := strings.Split(s, ".")
	return len(parts) == 3 && len(s) > 40
}

if _, err := management.ParseToken(token); err != nil {
	return fmt.Errorf("--token is not a valid management JWT: %w", err)
}

When it happens

Trigger: --token is provided with a value that is not a valid JWT (raw API key, truncated string, base64-without-JWT, whitespace/newlines), or the token came from a non-Access source.

Common situations: Pasting a Cloudflare API token or tunnel token instead of an Access management JWT; copying the token with surrounding quotes; token corruption in scripts.

Related errors

• empty application token
• unable to acquire management token for requested tunnel id:
• aud array contains non-string elements
• aud field is not a string or an array of strings
• metadata JWT aud is empty

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/ad2b1808177148a5. Report an issue: GitHub.