cloudflare/cloudflared · error

unable to acquire management token for requested tunnel id:

Error message

unable to acquire management token for requested tunnel id: %w

What it means

buildURL needs an Access management token to authenticate the tail session. When --token is not provided, it calls cliutil.GetManagementToken, which may require an Access login (cloudflared access login or an existing token file). Any failure there is wrapped with this message.

Source

Thrown at cmd/cloudflared/tail/cmd.go:215

		return nil, nil
	}

	return &management.StreamingFilters{
		Level:    level,
		Events:   events,
		Sampling: sample,
	}, nil
}

// buildURL will build the management url to contain the required query parameters to authenticate the request.
func buildURL(c *cli.Context, log *zerolog.Logger, res cfapi.ManagementResource) (url.URL, error) {
	var err error

	token := c.String("token")
	if token == "" {
		token, err = cliutil.GetManagementToken(c, log, res, buildInfo)
		if err != nil {
			return url.URL{}, fmt.Errorf("unable to acquire management token for requested tunnel id: %w", err)
		}
	}

	claims, err := management.ParseToken(token)
	if err != nil {
		return url.URL{}, fmt.Errorf("failed to determine if token is FED: %w", err)
	}

	var managementHostname string
	if claims.IsFed() {
		managementHostname = credentials.FedRampHostname
	} else {
		managementHostname = c.String(cfdflags.ManagementHostname)
	}

	query := url.Values{}
	query.Add("access_token", token)
	connector := c.String("connector-id")

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Pass --token explicitly with a valid management/Access token
2. Run `cloudflared access login <access-url>` first to establish cached credentials
3. Re-authenticate if the cached token expired; verify the token belongs to the tunnel's account
4. On headless hosts, generate a service token via Cloudflare Zero Trust and supply it via --token

Example fix

# before
cloudflared tail <tunnel-id>
# after
cloudflared tail --token $(cat ~/.cloudflared/management-token) <tunnel-id>

if token == "" {
	if _, err := os.Stat(tokenCachePath); err != nil {
		return errors.New("no management token; run `cloudflared access login` first")
	}
}

_, err := buildURL(c, log, res, buildInfo)
if err != nil && strings.Contains(err.Error(), "management token") {
	// prompt user to authenticate: cloudflared access login <url>
	return err
}

When it happens

Trigger: Running `cloudflared tail <tunnel-id>` without --token when no cached Access token exists for the account/tunnel, the user is not authenticated to Access, or the browser-based Access flow fails (headless machine, browser launch failure).

Common situations: Running tail on a headless server without an Access token, using a token for a different account than the tunnel, expired cached credentials, or CF_API_TOKEN environments lacking management scope.

Related errors

• empty application token
• failed to determine if token is FED: %w
• incorrect args
• not a valid url
• not a valid host

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/a22ce6c7c0b7cf91. Report an issue: GitHub.