What causes "unable to check for update: %d" in cloudflare/cloudflared?

Retry the update later — non-200 is often transient (5xx) or network-policy related.

unable to check for update: %d

Error message

unable to check for update: %d

What it means

The Workers-service based updater (Check) requests cloudflared's latest version metadata and requires HTTP 200. Any other status from the update endpoint (proxy interference, Cloudflare-side outage, rate limiting, captive portal) aborts the update check with this error carrying the status code.

Source

Thrown at cmd/cloudflared/updater/workers_service.go:84

	q.Add(ClientVersionName, s.currentVersion)

	if s.opts.IsBeta {
		q.Add(BetaKeyName, "true")
	}

	if s.opts.RequestedVersion != "" {
		q.Add(VersionKeyName, s.opts.RequestedVersion)
	}

	req.URL.RawQuery = q.Encode()
	resp, err := client.Do(req)
	if err != nil {
		return nil, err
	}
	defer resp.Body.Close()

	if resp.StatusCode != 200 {
		return nil, fmt.Errorf("unable to check for update: %d", resp.StatusCode)
	}

	var v VersionResponse
	if err := json.NewDecoder(resp.Body).Decode(&v); err != nil {
		return nil, err
	}

	if v.Error != "" {
		return nil, errors.New(v.Error)
	}

	versionToUpdate := ""
	if v.ShouldUpdate {
		versionToUpdate = v.Version
	}

	return NewWorkersVersion(v.URL, versionToUpdate, v.Checksum, s.targetPath, v.UserMessage, v.IsCompressed), nil
}

View on GitHub (pinned to 2253eeeb25)

Solutions

Retry the update later — non-200 is often transient (5xx) or network-policy related.
Check egress/proxy rules for the update endpoint host and allow it, or set proxy env vars (HTTPS_PROXY) so cloudflared can reach it.
Disable auto-updates (features: no auto-update in config or --no-autoupdate) and manage versions via your package manager instead.

Example fix

// before
cloudflared update   # fails behind corporate proxy
// after
export HTTPS_PROXY=http://proxy.corp:8080
cloudflared update
# or permanently:
# config.yml -> features: ["no-auto-update"]

Defensive patterns

Strategy: retry

Validate before calling

resp, err := http.Get("https://update.argotunnel.com/")
if err != nil || resp.StatusCode != http.StatusOK {
    // update endpoint unreachable or non-200; skip update attempt
}

Try / catch

// retry with backoff; fall back to skipping update
for i := 0; i < 3; i++ {
    if err := checkForUpdate(); err == nil { break }
    time.Sleep(time.Duration(1<<i) * time.Second)
}

Prevention

Run `cloudflared update` with network egress to the update endpoint (check proxies/firewalls).
Set HTTPS_PROXY in restricted networks.
Consider disabling auto-update and managing versions via a package manager.

When it happens

Trigger: Calling the update check path (`cloudflared update`, or periodic auto-update) when the workers.dev update service responds with a non-200 status — 4xx from a blocked/proxied network, 5xx during a service incident, or 403 from egress filtering.

Common situations: Corporate proxies/TLS interception rewriting the response; running behind a firewall that blocks the update endpoint; transient Cloudflare Workers errors; machines without proper DNS egress.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/7256d388c5568b27. Report an issue: GitHub.