cloudflare/cloudflared · error

invalid resource '%s': %w

Error message

invalid resource '%s': %w

What it means

The `cloudflared management token` command validates the --resource flag via parseResource before requesting a management token. If the resource string is not a recognized value, the parse error is wrapped as "invalid resource '%s': %w" and the command exits. This is a CLI input validation guard so a bad flag value fails fast instead of hitting the API.

Source

Thrown at cmd/cloudflared/management/cmd.go:76

				Name:    cfdflags.LogLevel,
				Value:   "info",
				Usage:   "Application logging level {debug, info, warn, error, fatal}",
				EnvVars: []string{"TUNNEL_LOGLEVEL"},
			},
			cliutil.FlagLogOutput,
		},
	}
}

// tokenCommand handles the token subcommand execution
func tokenCommand(c *cli.Context) error {
	log := cliutil.CreateStderrLogger(c)

	// Parse and validate resource flag
	resourceStr := c.String("resource")
	resource, err := parseResource(resourceStr)
	if err != nil {
		return fmt.Errorf("invalid resource '%s': %w", resourceStr, err)
	}

	// Get management token
	token, err := cliutil.GetManagementToken(c, log, resource, buildInfo)
	if err != nil {
		return err
	}

	// Output JSON to stdout
	tokenResponse := struct {
		Token string `json:"token"`
	}{Token: token}

	return json.NewEncoder(os.Stdout).Encode(tokenResponse)
}

// parseResource converts resource string to ManagementResource enum
func parseResource(resource string) (cfapi.ManagementResource, error) {

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Use exactly one of: logs, admin, host_details (all lowercase)
2. Check `cloudflared management token --help` for the accepted values in your version
3. Quote the value to avoid shell issues, e.g. --resource "host_details"

Example fix

// before
cloudflared management token --resource Logs

// after
cloudflared management token --resource logs

// shell: validate the flag before invoking
valid="logs admin host_details"
[[ " $valid " == *" $RESOURCE "* ]] || { echo "--resource must be one of: $valid" >&2; exit 2; }

// Go caller: treat exit as a usage error, inspect stderr
out, err := exec.Command("cloudflared", "management", "token", "--resource", r).CombinedOutput()
if err != nil && strings.Contains(string(out), "invalid resource") {
    return fmt.Errorf("usage error: %s", out)
}

When it happens

Trigger: Running `cloudflared management token --resource <value>` where <value> is anything other than "logs", "admin", or "host_details" (typo, wrong casing, or empty value).

Common situations: Typing `--resource Logs` (capitalized), `--resource log`, forgetting the value, or copying an outdated example from older docs/versions with a different resource set.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• invalid --output value provided, please make sure it is one
• must be one of: logs, admin, host_details
• not a valid host
• no input provided
• failed to parse Host

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/fe07baae2274651b. Report an issue: GitHub.