mastra-ai/mastra · error

data.errors[0].message

Error message

data.errors[0].message

What it means

`createSecret` calls the Cloudflare API and checks the response's `success` flag. When Cloudflare returns `success: false`, the code throws an Error built from `data.errors[0].message`, surfacing Cloudflare's own API error (auth failure, wrong account, permissions, validation) to the caller.

Source

Thrown at deployers/cloudflare/src/secrets-manager/index.ts:39

    const url = `${this.baseUrl}/accounts/${this.accountId}/workers/scripts/${workerId}/secrets`;

    try {
      const response = await fetch(url, {
        method: 'PUT',
        headers: {
          Authorization: `Bearer ${this.apiToken}`,
          'Content-Type': 'application/json',
        },
        body: JSON.stringify({
          name: secretName,
          text: secretValue,
        }),
      });

      const data = (await response.json()) as { success: boolean; result: any; errors: any[] };

      if (!data.success) {
        throw new Error(data.errors[0].message);
      }

      return data.result;
    } catch (error) {
      console.error('Failed to create secret:', error);
      throw error;
    }
  }

  async createProjectSecrets({
    workerId,
    customerId,
    envVars,
  }: {
    workerId: string;
    customerId: string;
    envVars: Record<string, string>;
  }) {

View on GitHub (pinned to 75dd419e61)

Solutions

1. Read the thrown message (the first Cloudflare error) and fix the underlying issue it names.
2. Verify the API token via /user/tokens/verify and grant it Workers secret-write permission for the target account.
3. Check the account ID / project binding passed to the secrets manager matches the Cloudflare account owning the worker.
4. Harden the throw against empty `errors` arrays to avoid a confusing secondary TypeError, then retry.

Example fix

// before
throw new Error(data.errors[0].message);
// after
throw new Error(`Cloudflare createSecret failed: ${data.errors?.[0]?.message ?? JSON.stringify(data.errors)}`);

// Verify Cloudflare credentials before calling createSecret
async function assertCloudflareTokenWorks(token: string): Promise<void> {
  const res = await fetch('https://api.cloudflare.com/client/v4/user/tokens/verify', {
    headers: { Authorization: `Bearer ${token}` },
  });
  const json: { success: boolean; errors?: { message: string }[] } = await res.json();
  if (!json.success) throw new Error(`Invalid Cloudflare token: ${json.errors?.[0]?.message ?? res.status}`);
}

interface CloudflareResponse { success: boolean; result: unknown; errors: { message: string }[] }
function isCloudflareError(data: unknown): data is CloudflareResponse & { success: false; errors: [{ message: string }, ...{ message: string }[]] } {
  const d = data as CloudflareResponse;
  return d.success === false && Array.isArray(d.errors) && d.errors.length > 0 && typeof d.errors[0]?.message === 'string';
}

try {
  await secretsManager.createSecret(projectName, name, value);
} catch (err) {
  if (err instanceof Error && /token|authentication|permission|not authorized/i.test(err.message)) {
    console.error('Cloudflare auth/permission problem creating secret:', err.message);
  } else if (err instanceof TypeError) {
    console.error('Unexpected Cloudflare response shape (errors array empty?):', err);
  } else throw err;
}

When it happens

Trigger: Any Cloudflare API response with `success: false` while creating a project secret — invalid/expired API token, wrong account ID, missing Workers Secrets permission, or invalid secret payload — with a non-empty `errors` array.

Common situations: CLOUDFLARE_API_TOKEN unset, expired after rotation, or scoped to the wrong account; token lacking Workers Scripts:Edit; mistyped account ID; secret name violating Cloudflare naming rules.

Related errors

• State token has expired
• Clerk JWKS URI, secret key and publishable key are required,
• Cookie password must be at least 32 characters for SSO. Set
• Redirect URI is required for SSO login
• Token exchange failed: ${error}

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/ecb222f81032248b. Report an issue: GitHub.