cloudflare/cloudflared · error

invalid management token format provided

Error message

invalid management token format provided

What it means

Raised by management.ParseToken when the token parses as a JWT but its claims fail verification: the tunnel claim requires a non-empty AccountTag and ID (and the actor claim a non-empty ID). The token is structurally valid but semantically incomplete, so it cannot identify a tunnel for the management connection.

Source

Thrown at management/token.go:56

// verify checks the ID claim isn't empty
func (t *actor) verify() bool {
	return t.ID != ""
}

func ParseToken(token string) (*managementTokenClaims, error) {
	jwt, err := jwt.ParseSigned(token, []jose.SignatureAlgorithm{jose.ES256})
	if err != nil {
		return nil, fmt.Errorf("malformed jwt: %v", err)
	}

	var claims managementTokenClaims
	// This is actually safe because we verify the token in the edge before it reaches cloudflared
	err = jwt.UnsafeClaimsWithoutVerification(&claims)
	if err != nil {
		return nil, fmt.Errorf("malformed jwt: %v", err)
	}
	if !claims.verify() {
		return nil, fmt.Errorf("invalid management token format provided")
	}
	return &claims, nil
}

func (m *managementTokenClaims) IsFed() bool {
	return m.Issuer == tunnelstoreFEDIssuer
}

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Obtain a fresh management token — this one is missing required claims (account tag / tunnel ID).
2. Verify the token came from the correct Cloudflare account and access flow.
3. Do not hand-edit token contents; claims are produced by the edge.

When it happens

Trigger: Thrown at management/token.go:56 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/712d30a8f95c9681. Report an issue: GitHub.