No longer able to use API token for auth

[thexeos]

What versions & operating system are you using?

System:
OS: Windows 11
Binaries:
Node: 22.14.0
npm: 11.10.1
npmPackages:
@cloudflare/vite-plugin: ^1.34.0 => 1.34.0
wrangler: ^4.86.0 => 4.86.0

Please provide a link to a minimal reproduction

N/A

Describe the Bug

> wrangler whoami
 ⛅️ wrangler 4.86.0
───────────────────
Getting User settings...
X [ERROR] Failed to fetch auth token: 400 Bad Request

X [ERROR] You are logged in with an API Token. Unset the CLOUDFLARE_API_TOKEN in the environment to log in via OAuth.

X [ERROR] Not logged in.

I tried:

• Account API Tokens (this one used to work about a week ago - its status shows as Active and it has no expiration date set)
• User API Tokens
• Global API Key

I can't use OAuth since I need to be able to interact with multiple different Cloudflare accounts and Wrangler does not work like that.

It used to work with just CLOUDFLARE_API_TOKEN in .env but I saw warning for missing .env.local so I also tried to use that and I've added CLOUDFLARE_ACCOUNT_ID to both files - but none of it works any more.

Please provide any relevant error logs

--- 2026-04-29T22:26:07.907Z debug
🪵  Writing logs to "wrangler-2026-04-29_22-26-07_701.log"
---

--- 2026-04-29T22:26:07.907Z log

 ⛅️ wrangler 4.86.0
───────────────────
---

--- 2026-04-29T22:26:07.916Z debug
Metrics dispatcher: Posting data {/* redacted */}
---

--- 2026-04-29T22:26:07.933Z log
Getting User settings...
---

--- 2026-04-29T22:26:07.935Z debug
fetching auth token grant_type=refresh_token&refresh_token=/* redacted */&client_id=54d11594-84e4-41aa-b438-e81b8fa78ee7
---

--- 2026-04-29T22:26:07.935Z debug
Checking if domain has Access enabled: dash.cloudflare.com
---

--- 2026-04-29T22:26:07.935Z debug
Access switch not cached for: dash.cloudflare.com
---

--- 2026-04-29T22:26:08.078Z debug
Caching access switch for: dash.cloudflare.com
---

--- 2026-04-29T22:26:08.078Z debug
Fetching auth token from https://dash.cloudflare.com/oauth2/token
---

--- 2026-04-29T22:26:08.731Z error
X [ERROR] Failed to fetch auth token: 400 Bad Request


---

--- 2026-04-29T22:26:08.735Z error
X [ERROR] You are logged in with an API Token. Unset the CLOUDFLARE_API_TOKEN in the environment to log in via OAuth.


---

--- 2026-04-29T22:26:08.736Z debug
Metrics dispatcher: Posting data {/* redacted */}
---

--- 2026-04-29T22:26:08.737Z log

---

--- 2026-04-29T22:26:08.738Z error
X [ERROR] Not logged in.


---

--- 2026-04-29T22:26:08.739Z debug
Error: Not logged in.
    at requireLoggedIn (...wrangler\wrangler-dist\cli.js:132674:11)
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
    at async performApiFetch (...wrangler\wrangler-dist\cli.js:132537:3)
    at async fetchInternal (...wrangler\wrangler-dist\cli.js:132579:20)
    at async fetchResult (...wrangler\wrangler-dist\cli.js:132827:47)
    at async getTokenType (...wrangler\wrangler-dist\cli.js:299371:5)
    at async getAuthType (...wrangler\wrangler-dist\cli.js:299362:21)
    at async getUserInfo (...wrangler\wrangler-dist\cli.js:299344:20)
    at async whoami (...wrangler\wrangler-dist\cli.js:299204:16)
    at async Object.handler (...wrangler\wrangler-dist\cli.js:299558:9)
---

[petebacondarwin]

Sorry to hear you are having problems logging in.

• If you remove the API token from the .env (and other related files) does it still say you are logging in via an API token?
• If so, then there must be an additional env var in the process. If you remove that what does it say now? I think it should just say "Not logged in".
• Are you able to login using OAuth (rather than API token)?
• Have you created a new API token recently? Or are you using an older one that might have expired?

The logs seem to suggest that you do not have an API token set, since it would not try to make a request to the OAuth endpoint.

When I set an API token in the env var I see:

WRANGLER_LOG=debug CLOUDFLARE_API_TOKEN=xxxx pnpx wrangler whoami
🪵  Writing logs to "..."
.env file not found at "/.../.env". Continuing... For more details, refer to https://developers.cloudflare.com/workers/wrangler/system-environment-variables/
.env file not found at "/.../.env.local". Continuing... For more details, refer to https://developers.cloudflare.com/workers/wrangler/system-environment-variables/

 ⛅️ wrangler 4.86.0
───────────────────
Metrics dispatcher: Posting data {...}
Getting User settings...
-- START CF API REQUEST: GET https://api.cloudflare.com/client/v4/user/tokens/verify

Note that it goes straight for the user/tokens/verify request not the fetching auth token request.

[thexeos]

It appears the issue is with OAuth token refresh logic having highest priority in auth flow in Wrangler. When I went to project that had OAuth enabled and Wrangler was "logged in" to - it renewed the token first thing (and did so successfully) and then following requests with Wrangler in API Token projects started working.

So there is a bug with priority when it comes to which token will get used. Wrangler notices there is an expired OAuth token and would not advance to use .env-set API Token until that OAuth token is renewed.

[petebacondarwin]

Hi @thexeos - I am struggling to reproduce this issue. Please can you create a project where you set the API token (it can be a fake one that I will replace) via .env. Then provide exact steps that reproduce this problem. Perhaps it requires me to corrupt a current OAuth token or something?

[thexeos]

I pointed Claude Code at the log and source code and this is what it concluded:

Account API Tokens (and User API Tokens — anything from CLOUDFLARE_API_TOKEN) do not need OAuth refresh and have no refresh mechanism in wrangler. They're long-lived credentials issued from the dashboard and are sent as-is in the Authorization: Bearer … header (packages/wrangler/src/cfetch/internal.ts:317-330). They expire only by the TTL you set when creating them in the Cloudflare dashboard, or by manual revocation — and when they do expire, the API just returns 401 on the actual call. There is no token-endpoint exchange involved.

The refresh you saw is purely the OAuth flow trying to renew the OAuth access token stored in ~/.config/.wrangler/config/default.toml (or equivalent on your Windows path: C:\Users\User\AppData\Roaming\xdg.config\.wrangler\config\default.toml). The Eh_6x5b… value in the request body is the OAuth refresh token from that file, not anything derived from your CLOUDFLARE_API_TOKEN.

So this is the wrong code path being selected. The bug is in loginOrRefreshIfRequired (packages/wrangler/src/user/user.ts:980-1004):

  if (!getAPIToken()) {
    return !isNonInteractiveOrCI() && (await login(complianceConfig, props));
  } else if (isAccessTokenExpired()) {
    const didRefresh = await refreshToken();
    ...
  }

getAPIToken() returns the env token first (priority order at user.ts:473-489), so when both env and stored OAuth state exist, the env credential is what will actually be used for the API call. But isAccessTokenExpired() checks localState.accessToken regardless of which credential getAPIToken() chose. If the stored OAuth access token happens to be expired, wrangler refreshes it — even though it isn't going to be used for anything in this run.

This is doubly wrong with your current setup: not only is the refresh pointless, it also fails (apparently the OAuth refresh token on disk is no longer valid), and the failure path then routes through login() which immediately errors because env is set, killing the command. Your env-token API call never actually fires.

The fix would be in loginOrRefreshIfRequired: only attempt OAuth refresh when the OAuth token is the one that's going
to be used — i.e., when getAuthFromEnv() is undefined. Something like:

  } else if (!getAuthFromEnv() && isAccessTokenExpired()) {
    const didRefresh = await refreshToken();
    ...
  }

With that, env-set runs would skip OAuth maintenance entirely and just use the env token.