Specified origin urls using both --url and argument. Decide

Error message

Specified origin urls using both --url and argument. Decide which one you want, I can only support one.

What it means

ValidateUrl checks the origin URL, which can come from the --url flag or from a positional argument. When both are present in a context that allows arguments (allowURLFromArgs, e.g. the ssh subcommand), the source is ambiguous, so the library refuses to pick one and returns this error.

Source

Thrown at config/configuration.go:169

	return path
}

// ValidateUnixSocket ensures --unix-socket param is used exclusively
// i.e. it fails if a user specifies both --url and --unix-socket
func ValidateUnixSocket(c *cli.Context) (string, error) {
	if c.IsSet("unix-socket") && (c.IsSet("url") || c.NArg() > 0) {
		return "", errors.New("--unix-socket must be used exclusively.")
	}
	return c.String("unix-socket"), nil
}

// ValidateUrl will validate url flag correctness. It can be either from --url or argument
// Notice ValidateUnixSocket, it will enforce --unix-socket is not used with --url or argument
func ValidateUrl(c *cli.Context, allowURLFromArgs bool) (*url.URL, error) {
	var url = c.String("url")
	if allowURLFromArgs && c.NArg() > 0 {
		if c.IsSet("url") {
			return nil, errors.New("Specified origin urls using both --url and argument. Decide which one you want, I can only support one.")
		}
		url = c.Args().Get(0)
	}
	validUrl, err := validation.ValidateUrl(url)
	return validUrl, err
}

type UnvalidatedIngressRule struct {
	Hostname      string              `json:"hostname,omitempty"`
	Path          string              `json:"path,omitempty"`
	Service       string              `json:"service,omitempty"`
	OriginRequest OriginRequestConfig `yaml:"originRequest" json:"originRequest"`
}

// OriginRequestConfig is a set of optional fields that users may set to
// customize how cloudflared sends requests to origin services. It is used to set
// up general config that apply to all rules, and also, specific per-rule
// config.

View on GitHub (pinned to 2253eeeb25)

Solutions

Remove the --url flag and keep only the positional argument, or drop the argument and keep --url
Check the cloudflared config file for a 'url:' entry that is being merged with the command-line argument
For ssh-style usage, pass only the destination as the argument and let --url default

Example fix

// before
cloudflared access ssh --url http://localhost:8080 myhost.example.com
// after
cloudflared access ssh myhost.example.com

Defensive patterns

Strategy: validation

Validate before calling

if allowURLFromArgs && c.NArg() > 0 && c.IsSet("url") {
    return errors.New("choose either --url or a positional argument for the origin")
}

Type guard

func originSourceIsAmbiguous(c *cli.Context, allowArgs bool) bool {
    return allowArgs && c.NArg() > 0 && c.IsSet("url")
}

Prevention

Pick a single convention (flag vs argument) for origin URLs in your scripts
Check config-file 'url:' entries that merge with CLI arguments
Validate arguments before invoking cloudflared subcommands that accept positional URLs

When it happens

Trigger: ValidateUrl is called with allowURLFromArgs=true and c.NArg() > 0 while c.IsSet("url") is also true — e.g. `cloudflared access ssh --url http://localhost:8080 destination` or a merged config where both exist.

Common situations: Users passing the destination host as an argument while also supplying --url; tooling that injects --url automatically while the user also types a positional argument; config files merged with CLI flags.

Understand the failure class

Background: "mutually exclusive" flag errors: what "can't supply both nx and xx", "--raw is not compatible with -i" and "cannot be used with" mean, and how to fix them — this error's family across 29 libraries.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/0e8996f9bc422cdd. Report an issue: GitHub.