cloudflare/cloudflared · error

malformed jwt: %v

Error message

malformed jwt: %v

What it means

Raised by management.ParseToken when jose's jwt.ParseSigned fails on the management token: the token is not a syntactically valid compact JWS or is not signed with ES256. Used by `cloudflared tail` (buildURL) to inspect token claims before connecting; a malformed token means the access token passed via --token is corrupt or truncated.

Source

Thrown at management/token.go:46

// verify compares the tun claim isn't empty
func (t *tunnel) verify() bool {
	return t.AccountTag != "" && t.ID != ""
}

type actor struct {
	ID      string `json:"id"`
	Support bool   `json:"support"`
}

// verify checks the ID claim isn't empty
func (t *actor) verify() bool {
	return t.ID != ""
}

func ParseToken(token string) (*managementTokenClaims, error) {
	jwt, err := jwt.ParseSigned(token, []jose.SignatureAlgorithm{jose.ES256})
	if err != nil {
		return nil, fmt.Errorf("malformed jwt: %v", err)
	}

	var claims managementTokenClaims
	// This is actually safe because we verify the token in the edge before it reaches cloudflared
	err = jwt.UnsafeClaimsWithoutVerification(&claims)
	if err != nil {
		return nil, fmt.Errorf("malformed jwt: %v", err)
	}
	if !claims.verify() {
		return nil, fmt.Errorf("invalid management token format provided")
	}
	return &claims, nil
}

func (m *managementTokenClaims) IsFed() bool {
	return m.Issuer == tunnelstoreFEDIssuer
}

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Re-run `cloudflared tunnel login` / re-fetch the management token; the current token is corrupt.
2. Ensure the full token string was passed (no truncation or shell quoting damage).
3. Confirm the token is an ES256-signed JWT from Cloudflare access.

When it happens

Trigger: Thrown at management/token.go:46 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/9036ff09b58bebdc. Report an issue: GitHub.