cloudflare/cloudflared · error

failed to verify token

Error message

failed to verify token

What it means

cloudflared access verifies that the Access token you are using is actually accepted by Cloudflare's edge before proceeding. verifyTokenAtEdge calls isTokenValid, which makes a request through the Access application and checks the response; if the response indicates the token was rejected (not a valid/authenticated response), this error is thrown. It means the token exists but the edge did not accept it as valid for this application.

Source

Thrown at cmd/cloudflared/access/cmd.go:569

	if c.IsSet(sshTokenSecretFlag) {
		headers.Add(cfAccessClientSecretHeader, c.String(sshTokenSecretFlag))
	}
	options := &carrier.StartOptions{AppInfo: appInfo, OriginURL: appUrl.String(), Headers: headers, AutoCloseInterstitial: c.Bool(cfdflags.AutoCloseInterstitial), IsFedramp: c.Bool(fedrampFlag)}

	if valid, err := isTokenValid(options, log); err != nil {
		return err
	} else if valid {
		return nil
	}

	if err := token.RemoveTokenIfExists(appInfo); err != nil {
		return err
	}

	if valid, err := isTokenValid(options, log); err != nil {
		return err
	} else if !valid {
		return errors.New("failed to verify token")
	}

	return nil
}

// isTokenValid makes a request to the origin and returns true if the response was not a 302.
func isTokenValid(options *carrier.StartOptions, log *zerolog.Logger) (bool, error) {
	req, err := carrier.BuildAccessRequest(options, log)
	if err != nil {
		return false, errors.Wrap(err, "Could not create access request")
	}
	req.Header.Set("User-Agent", userAgent)

	query := req.URL.Query()
	query.Set("cloudflared_token_check", "true")
	req.URL.RawQuery = query.Encode()

	// Do not follow redirects

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Re-authenticate to get a fresh token: run `cloudflared access login <url>` again or re-export CF_ACCESS_TOKEN.
2. Verify the token matches the application you are accessing (correct aud/AUD tag; use `cloudflared access curl` with the exact app URL).
3. If using a service token, confirm it is still active in Zero Trust (Access > Service Auth) and bound to the right application policy.
4. Check local clock skew; severely skewed clocks can invalidate token validation.

Example fix

// before
export CF_ACCESS_TOKEN=<old-expired-token>
cloudflared access curl https://app.example.com
// after
cloudflared access login https://app.example.com  # obtain fresh token
cloudflared access curl https://app.example.com

if token == "" || len(token) < 100 {
    return errors.New("access token missing or looks truncated; re-run `cloudflared access login <url>`")
}

if _, err := verifyTokenAtEdge(options, log); err != nil {
    if strings.Contains(err.Error(), "failed to verify token") {
        // trigger re-authentication flow before surfacing to user
        return fmt.Errorf("token rejected by edge; re-authenticate: %w", err)
    }
    return err
}

When it happens

Trigger: Running `cloudflared access login` or `cloudflared access curl` with a token that has expired, was revoked, was issued for a different Access application/audience (aud mismatch), or was corrupted/truncated when passed via --token or CF_ACCESS_TOKEN.

Common situations: CI pipelines reusing a long-expired service token; copying only part of the token from the browser cookie; token generated for app A used against app B; IdP session revoked after token issuance.

Related errors

• empty application token
• unable to acquire management token for requested tunnel id:
• token is invalid: %s
• failed to get checksums: {0}
• failed to upload checksum: {0}

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/c2cd61c5e8c20713. Report an issue: GitHub.