cube-js/cube · error · Error

Provided token isn't for ${dotCubeCloud.url}

Error message

Provided token isn't for ${dotCubeCloud.url}

What it means

CubeCloudConfig.deployAuthForCurrentDir validates that the locally stored Cube Cloud auth token actually belongs to the configured cloud URL. `deployAuth(url)` returns a map keyed by URLs the token is valid for; if the current `.cubecloud` file's url is not a key in that map, the token was issued for a different cloud deployment, so it throws.

Source

Thrown at packages/cubejs-cli/src/config.ts:29

    if (config.auth) {
      return config.auth;
    }

    const auth = await inquirer.prompt([{
      name: 'auth',
      message: `Cube Cloud Auth Token${url ? ` for ${url}` : ''}`
    }]);

    return (await this.addAuthToken(auth.auth, config)).auth;
  }

  public async deployAuthForCurrentDir() {
    const dotCubeCloud = await this.loadDotCubeCloud();
    if (dotCubeCloud.url && dotCubeCloud.deploymentId) {
      const deployAuth = await this.deployAuth(dotCubeCloud.url);
      if (!deployAuth[dotCubeCloud.url]) {
        throw new Error(`Provided token isn't for ${dotCubeCloud.url}`);
      }

      return {
        ...deployAuth[dotCubeCloud.url],
        url: dotCubeCloud.url,
        deploymentId: dotCubeCloud.deploymentId
      };
    }

    const auth = await this.deployAuth();
    let url = Object.keys(auth)[0];
    if (Object.keys(auth).length > 1) {
      // eslint-disable-next-line prefer-destructuring
      url = (await inquirer.prompt([{
        type: 'list',
        name: 'url',
        message: 'Please select an organization',
        choices: Object.keys(auth)

View on GitHub (pinned to 7d981676b3)

Solutions

1. Re-authenticate with `cubejs login` (or the cloud token command) against the correct Cube Cloud URL so the token matches dotCubeCloud.url
2. Delete the stale .cubecloud file in the project directory and re-run deploy to reconfigure
3. Verify the url field in .cubecloud matches the cloud instance you are authenticated to
4. Confirm your Cube Cloud API token hasn't been revoked in the cloud UI settings

Example fix

// before (.cubecloud points to wrong instance)
{ "url": "https://cloud.other-org.cubecloud.dev", "deploymentId": "..." }
// after
$ cubejs login
{ "url": "https://cloud.myorg.cubecloud.dev", "deploymentId": "..." }

const cfg = JSON.parse(fs.readFileSync('.cubecloud', 'utf8'));
const deployAuth = JSON.parse(fs.readFileSync(path.join(os.homedir(), '.cubecloud'), 'utf8'));
if (!deployAuth[cfg.url]) {
  console.warn(`Token is not valid for ${cfg.url}; run 'cubejs login' first`);
}

When it happens

Trigger: Running `cubejs deploy` (or any command calling cubeCloudClient) when the token in ~/.cubecloud or .cubecloud was created against a different Cube Cloud domain than dotCubeCloud.url, or the token was revoked/expired server-side so the URL mapping is missing.

Common situations: Working across multiple Cube Cloud instances/organizations; a colleague shared a .cubecloud file from another deployment; re-authenticating after SSO org change; stale token after the deployment URL changed.

Related errors

• JSON.stringify(deployments)
• context `{name}` not found in config (run `cube login --cont
• not logged in: run `cube login`, or set CUBE_API_URL and CUB
• device code expired before it was authorized; run `cube logi
• authorization was denied in the browser

AI-assisted analysis of cube-js/cube@7d981676b3 (2026-09-02). Data as JSON: /api/errors/845575af4662f455. Report an issue: GitHub.