cloudflare/cloudflared · error

failed to generate app token file path

Error message

failed to generate app token file path

What it means

getToken wraps this error when GenerateAppTokenFilePathFromURL fails to derive the on-disk path where the app token should be cached. Path generation can fail when the app hostname or AUD produces an invalid file path (e.g. unsafe characters, URL parsing failure). Without a path, the token cannot be cached or locked.

Source

Thrown at token/token.go:343

func FetchTokenWithRedirect(appURL *url.URL, appInfo *AppInfo, autoClose bool, isFedramp bool, log *zerolog.Logger) (string, error) {
	return getToken(appURL, appInfo, false, autoClose, isFedramp, log)
}

// FetchToken will either load a stored token or generate a new one
// it appends the host of the appURL as the redirect URL to the access cli request if opening the browser
func FetchToken(appURL *url.URL, appInfo *AppInfo, autoClose bool, isFedramp bool, log *zerolog.Logger) (string, error) {
	return getToken(appURL, appInfo, true, autoClose, isFedramp, log)
}

// getToken will either load a stored token or generate a new one
func getToken(appURL *url.URL, appInfo *AppInfo, useHostOnly bool, autoClose bool, isFedramp bool, log *zerolog.Logger) (string, error) {
	if token, err := GetAppTokenIfExists(appInfo); token != "" && err == nil {
		return token, nil
	}

	appTokenPath, err := GenerateAppTokenFilePathFromURL(appInfo.AppHostname, appInfo.AppAUD, keyName)
	if err != nil {
		return "", errors.Wrap(err, "failed to generate app token file path")
	}

	appTokenLock, err := acquireLockFile(appTokenPath, log)
	if err != nil {
		return "", errors.Wrap(err, "failed to acquire app token lock")
	}
	defer appTokenLock.release()

	// check to see if another process has gotten a token while we waited for the lock
	if token, err := GetAppTokenIfExists(appInfo); token != "" && err == nil {
		return token, nil
	}

	// If an app token couldn't be found on disk, check for an org token and attempt to exchange it for an app token.
	var orgTokenPath string
	orgToken, orgTokenErr := GetOrgTokenIfExists(appInfo.AuthDomain)
	if orgTokenErr != nil {
		orgTokenPath, err = generateOrgTokenFilePathFromURL(appInfo.AuthDomain)

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Inspect the wrapped cause to see which input (hostname, AUD, keyName) was rejected
2. Verify the app hostname in the tunnel configuration is a valid hostname with no scheme, path, or port oddities
3. Ensure AppAUD is set to the expected access application AUD string with no stray whitespace
4. Confirm the token storage directory configuration is sane; then retry the token fetch

// validate hostname before token fetch
if appInfo.AppHostname == "" || strings.ContainsAny(appInfo.AppHostname, "/: ") {
	return fmt.Errorf("invalid app hostname for token path: %q", appInfo.AppHostname)
}

token, err := FetchToken(appURL, appAUD, keyName, useHostOnly, autoClose, isFedramp, log)
if err != nil && strings.Contains(err.Error(), "failed to generate app token file path") {
	// configuration problem: inspect AppHostname/AppAUD in tunnel config
	log.Error().Err(err).Str("hostname", appInfo.AppHostname).Msg("bad token path inputs")
}

When it happens

Trigger: Calling FetchToken / FetchTokenWithRedirect -> getToken where GenerateAppTokenFilePathFromURL(appInfo.AppHostname, appInfo.AppAUD, keyName) returns an error — typically because AppHostname or the AUD cannot be converted into a safe filename.

Common situations: Malformed or empty AppHostname in tunnel/origin configuration; unusual characters in the hostname or AUD after a configuration change; corrupted originRequest config in the tunnel YAML feeding an unexpected hostname value.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• failed to generate org token file path
• the argument path must be a directory
• write token to %s: %w
• write token to configuration directory at %s: %w
• failed to create lock file %s

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/857fac357412dfad. Report an issue: GitHub.