What causes "failed to read quick-tunnel response" in cloudflare/cloudflared?

Retry the quick tunnel command — usually transient

failed to read quick-tunnel response

Error message

failed to read quick-tunnel response

What it means

Reading the body of the quick-tunnel provisioning response failed. cloudflared reads the whole response into memory (io.ReadAll) so it can surface it in error output; if the stream errors mid-read, this wrapped error is returned.

Source

Thrown at cmd/cloudflared/tunnel/quick_tunnel.go:80

	}

	req, err := http.NewRequest(http.MethodPost, fmt.Sprintf("%s/tunnel", sc.c.String("quick-service")), bytes.NewReader(reqBody))
	if err != nil {
		return errors.Wrap(err, "failed to build quick tunnel request")
	}
	req.Header.Add("Content-Type", "application/json")
	req.Header.Add("User-Agent", buildInfo.UserAgent())

	resp, err := client.Do(req)
	if err != nil {
		return errors.Wrap(err, "failed to request quick Tunnel")
	}
	defer func() { _ = resp.Body.Close() }()

	// This will read the entire response into memory so we can print it in case of error
	respBody, err := io.ReadAll(resp.Body)
	if err != nil {
		return errors.Wrap(err, "failed to read quick-tunnel response")
	}

	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
		var data QuickTunnelResponse
		if err := json.Unmarshal(respBody, &data); err == nil && len(data.Errors) > 0 {
			return fmt.Errorf("quick tunnel provisioning failed with status %d: %s", resp.StatusCode, formatQuickTunnelErrors(data.Errors))
		}
		return fmt.Errorf("quick tunnel provisioning failed with status %d: %s", resp.StatusCode, string(respBody))
	}

	var data QuickTunnelResponse
	if err := json.Unmarshal(respBody, &data); err != nil {
		respString := string(respBody)
		fields := map[string]interface{}{"status_code": resp.Status}
		sc.log.Err(err).Fields(fields).Msgf("Error unmarshaling QuickTunnel response: %s", respString)
		return errors.Wrap(err, "failed to unmarshal quick Tunnel")
	}

View on GitHub (pinned to 2253eeeb25)

Solutions

Retry the quick tunnel command — usually transient
Check for middleboxes/proxies that cut long-lived connections
Run with `--loglevel debug` and inspect the wrapped error for 'connection reset' or 'unexpected EOF'
If consistently reproducible, test the endpoint directly with curl

Defensive patterns

Strategy: retry

Try / catch

resp, err := client.Do(req)
if err == nil {
    if _, err := io.ReadAll(resp.Body); err != nil {
        // treat as transient: retry with backoff
        _ = resp.Body.Close()
    }
}

Prevention

Avoid running provisioning over flaky VPN/links
Disable middleboxes that reset idle connections
Retry once automatically on read errors

When it happens

Trigger: io.ReadAll(resp.Body) returns an error after a successful client.Do — the connection was reset or timed out while reading the response body.

Common situations: Unstable networks or VPNs dropping the connection mid-response; proxies terminating the connection; server closing the connection prematurely under load.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/49fffe42ff48bab8. Report an issue: GitHub.