cloudflare/cloudflared · error

region provided with a token that has an endpoint

Error message

region provided with a token that has an endpoint

What it means

Region and the endpoint embedded in remotely-managed tunnel credentials are interchangeable; specifying `--region` while the token's credentials already carry an endpoint is ambiguous, so prepareTunnelConfig rejects the combination.

Source

Thrown at cmd/cloudflared/tunnel/configuration.go:198

		return nil, nil, err
	}
	if err := testIPBindable(edgeBindAddr); err != nil {
		return nil, nil, fmt.Errorf("invalid edge-bind-address %s: %v", edgeBindAddr, err)
	}
	edgeIPVersion, err = adjustIPVersionByBindAddress(edgeIPVersion, edgeBindAddr)
	if err != nil {
		// This is not a fatal error, we just overrode edgeIPVersion
		log.Warn().Str("edgeIPVersion", edgeIPVersion.String()).Err(err).Msg("Overriding edge-ip-version")
	}

	region := c.String(flags.Region)
	endpoint := namedTunnel.Credentials.Endpoint
	var resolvedRegion string
	// set resolvedRegion to either the region passed as argument
	// or to the endpoint in the credentials.
	// Region and endpoint are interchangeable
	if region != "" && endpoint != "" {
		return nil, nil, fmt.Errorf("region provided with a token that has an endpoint")
	} else if region != "" {
		resolvedRegion = region
	} else if endpoint != "" {
		resolvedRegion = endpoint
	}

	warpRoutingConfig := ingress.NewWarpRoutingConfig(&cfg.WarpRouting)

	// Setup origin dialer service and virtual services
	originDialerService := ingress.NewOriginDialer(ingress.OriginConfig{
		DefaultDialer:   ingress.NewDialer(warpRoutingConfig),
		TCPWriteTimeout: c.Duration(flags.WriteStreamTimeout),
	}, log)

	// Setup DNS Resolver Service
	originMetrics := origins.NewMetrics(prometheus.DefaultRegisterer)
	dnsResolverAddrs := c.StringSlice(flags.VirtualDNSServiceResolverAddresses)
	dnsService := origins.NewDNSResolverService(origins.NewDNSDialer(), log, originMetrics)

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Drop the `--region` flag and let the token's embedded endpoint decide the region.
2. Or request/issue a token without an embedded endpoint if you must control region via the flag.
3. Check the credentials/token payload's endpoint field to confirm which region it targets before running.

Example fix

// before
cloudflared tunnel run --region us --token $TUNNEL_TOKEN
// after
cloudflared tunnel run --token $TUNNEL_TOKEN

// shell: never pass --region when using a remotely-provisioned token
args=(tunnel run --token "$TUNNEL_TOKEN")
[ -z "$REGION" ] || args+=(--region "$REGION")  # only for locally-managed tunnels
exec cloudflared "${args[@]}"

When it happens

Trigger: Running `cloudflared tunnel run --region us --token <token>` where the token was issued with an explicit endpoint baked into its credentials (Endpoint field non-empty).

Common situations: Users in non-US regions adding `--region` on top of a pre-provisioned token that already targets a specific endpoint; copy-pasted run commands from different environments.

Related errors

• No configuration file was found. Please create one, or use t
• ErrNoIngressRulesCLI
• Did not receive final destination from client. The --destina
• configuration file %s must contain entries for the tunnel to
• possible conflicting configuration in %[1]s and %[2]s. Eithe

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/333306d358ce0997. Report an issue: GitHub.