What causes "must be one of: logs, admin, host_details" in cloudflare/cloudflared?

Pass one of the exact lowercase values: logs, admin, host_details

must be one of: logs, admin, host_details

Error message

must be one of: logs, admin, host_details

What it means

parseResource maps a resource string to the cfapi.ManagementResource enum and returns "must be one of: logs, admin, host_details" for any unrecognized value. This is the inner error that tokenCommand wraps; it defines the exhaustive set of valid management resources.

Source

Thrown at cmd/cloudflared/management/cmd.go:103

	// Output JSON to stdout
	tokenResponse := struct {
		Token string `json:"token"`
	}{Token: token}

	return json.NewEncoder(os.Stdout).Encode(tokenResponse)
}

// parseResource converts resource string to ManagementResource enum
func parseResource(resource string) (cfapi.ManagementResource, error) {
	switch resource {
	case "logs":
		return cfapi.Logs, nil
	case "admin":
		return cfapi.Admin, nil
	case "host_details":
		return cfapi.HostDetails, nil
	default:
		return 0, fmt.Errorf("must be one of: logs, admin, host_details")
	}
}

View on GitHub (pinned to 2253eeeb25)

Solutions

Pass one of the exact lowercase values: logs, admin, host_details
Trim surrounding whitespace from the value if it comes from a script or env var
Consult the docs for your cloudflared version, as the valid resource set may evolve

Defensive patterns

Strategy: validation

Validate before calling

// Go: validate before calling parseResource
func isValidResource(s string) bool {
    switch s { case "logs", "admin", "host_details": return true }
    return false
}

Try / catch

r, err := parseResource(s)
if err != nil {
    return fmt.Errorf("unsupported management resource %q: %w", s, err)
}

Prevention

Define the resource strings as constants shared by flag parsing and business logic
Reject unknown values early at CLI/flag-validation time with the allowed set in the message
Add a table-driven test enumerating valid and invalid resource strings

When it happens

Trigger: Called by tokenCommand (from the --resource flag) with a string other than "logs", "admin", or "host_details".

Common situations: Misspelling a resource name, wrong letter case, trailing whitespace, or using a resource removed/renamed in a newer cloudflared version.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/e2937ce11f667d19. Report an issue: GitHub.