What causes "failed to remove cached token with unexpected audience: %w" in cloudflare/cloudflared?

Manually delete the cached token file in the cloudflared token cache directory and re-run login.

failed to remove cached token with unexpected audience: %w

Error message

failed to remove cached token with unexpected audience: %w

What it means

GetAppTokenIfExists found a cached Access token on disk whose audience (Aud claim) does not match the application the user is trying to reach. cloudflared attempts to delete the stale cache file so a fresh token can be minted; this error is thrown when that os.Remove fails with a non-FileNotFound error. The user cannot proceed until the bad cache file is cleared.

Source

Thrown at token/token.go:628

		return "", err
	}
	token, err := getTokenIfExists(path)
	if err != nil {
		return "", err
	}
	var payload jwtPayload
	err = json.Unmarshal(token.UnsafePayloadWithoutVerification(), &payload)
	if err != nil {
		return "", err
	}

	if payload.isExpired() {
		err := os.Remove(path)
		return "", err
	}
	if !slices.Contains(payload.Aud, appInfo.AppAUD) {
		if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
			return "", fmt.Errorf("failed to remove cached token with unexpected audience: %w", err)
		}
		return "", fmt.Errorf("cached token audience does not include expected application audience %q", appInfo.AppAUD)
	}

	return token.CompactSerialize()
}

// GetTokenIfExists will return the token from local storage if it exists and not expired
func getTokenIfExists(path string) (*jose.JSONWebSignature, error) {
	content, err := os.ReadFile(path) // nolint: gosec
	if err != nil {
		return nil, err
	}
	token, err := jose.ParseSigned(string(content), signatureAlgs)
	if err != nil {
		return nil, err
	}
	return token, nil

View on GitHub (pinned to 2253eeeb25)

Solutions

Manually delete the cached token file in the cloudflared token cache directory and re-run login.
Check filesystem permissions/write access on the cache directory and file.
On Windows, close processes (AV scanners, editors) holding the cache file open.
Ensure all Access apps use their correct AppAUD so the right cache path is used.

Example fix

// before
err := os.Remove(path)
return "", fmt.Errorf("failed to remove cached token with unexpected audience: %w", err)
// after
if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
    return "", fmt.Errorf("failed to remove cached token with unexpected audience: %w", err)
}
// proceed to fetch a new token for appInfo.AppAUD

Defensive patterns

Strategy: try-catch

Try / catch

token, err := token.GetAppTokenIfExists(appInfo)
if err != nil {
    if strings.Contains(err.Error(), "failed to remove cached token") {
        // delete the cache file manually or warn user about permissions
    }
    return err
}

Prevention

Keep the token cache directory writable by the running user
Avoid running multiple cloudflared processes that share the same cache concurrently
Clear cache files when switching between Access applications

When it happens

Trigger: Calling GetAppTokenIfExists (via login, curl, or generateToken) when (1) the cached token's aud claim differs from appInfo.AppAUD and (2) os.Remove(path) fails for a reason other than the file not existing.

Common situations: Cache file permissions changed or file locked by another process (Windows AV/indexer holding the file), read-only filesystem, or a stale cache written by a different Access application under the same cache directory.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/a0371cb167f38d2e. Report an issue: GitHub.