cloudflare/cloudflared · error

failed to generate org token file path

Error message

failed to generate org token file path

What it means

getToken wraps this error when generateOrgTokenFilePathFromURL fails while building the cache path for the org token. This only happens when no org token exists on disk yet (GetOrgTokenIfExists errored) and the code needs a path to store one. A failure here means the org-token exchange flow cannot proceed on disk.

Source

Thrown at token/token.go:363

	appTokenLock, err := acquireLockFile(appTokenPath, log)
	if err != nil {
		return "", errors.Wrap(err, "failed to acquire app token lock")
	}
	defer appTokenLock.release()

	// check to see if another process has gotten a token while we waited for the lock
	if token, err := GetAppTokenIfExists(appInfo); token != "" && err == nil {
		return token, nil
	}

	// If an app token couldn't be found on disk, check for an org token and attempt to exchange it for an app token.
	var orgTokenPath string
	orgToken, orgTokenErr := GetOrgTokenIfExists(appInfo.AuthDomain)
	if orgTokenErr != nil {
		orgTokenPath, err = generateOrgTokenFilePathFromURL(appInfo.AuthDomain)
		if err != nil {
			return "", errors.Wrap(err, "failed to generate org token file path")
		}

		orgTokenLock, orgLockErr := acquireLockFile(orgTokenPath, log)
		if orgLockErr != nil {
			return "", errors.Wrap(orgLockErr, "failed to acquire org token lock")
		}
		defer orgTokenLock.release()
		// check if an org token has been created since the lock was acquired
		orgToken, orgTokenErr = GetOrgTokenIfExists(appInfo.AuthDomain)
	}
	if orgTokenErr == nil {
		if appToken, exchangeErr := exchangeOrgToken(appURL, orgToken); exchangeErr != nil {
			log.Debug().Msgf("failed to exchange org token for app token: %s", exchangeErr)
		} else {
			// generate app path
			if err := os.WriteFile(appTokenPath, []byte(appToken), 0600); err != nil { // nolint: gosec
				return "", errors.Wrap(err, "failed to write app token to disk")
			}

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Inspect the wrapped cause to identify which part of AuthDomain failed path conversion
2. Verify the auth domain in the tunnel config is a valid hostname URL (e.g. https://<team>.cloudflareaccess.com) with no trailing junk
3. Fix any environment/config source supplying the auth domain and restart cloudflared
4. Clear stale token files and retry: rm -f ~/.cloudflared/org-token*

// validate the auth domain parses as a URL before token operations
u, err := url.Parse(authDomain)
if err != nil || u.Host == "" {
	return fmt.Errorf("invalid auth domain %q: %w", authDomain, err)
}

token, err := FetchToken(...)
if err != nil && strings.Contains(err.Error(), "failed to generate org token file path") {
	log.Error().Err(err).Str("authDomain", authDomain).Msg("auth domain cannot be converted to token path; check config")
}

When it happens

Trigger: FetchToken -> getToken where GetOrgTokenIfExists(appInfo.AuthDomain) returns an error AND generateOrgTokenFilePathFromURL(appInfo.AuthDomain) also fails — the auth domain URL cannot be converted to a valid file path (invalid characters, unparsable URL).

Common situations: AuthDomain configured as a malformed URL (missing scheme, stray characters) in tunnel configuration; environment variables supplying an invalid auth domain; changes to team name / auth domain format that path generation does not accept.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• failed to generate app token file path
• the argument path must be a directory
• write token to %s: %w
• write token to configuration directory at %s: %w
• failed to create lock file %s

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/d8b603a40e3d84cc. Report an issue: GitHub.