add auth profiles to wrangler by emily-shen · Pull Request #13975 · cloudflare/workers-sdk

emily-shen · 2026-05-19T16:14:31Z

Supersedes #11780

'Profiles' are essentially just Oauth tokens that you can switch between without re-authing. The main change compared to the earlier PR is that you can now bind a profile to a particular directory. This is similar to account_id in wrangler config, except set at the global context to keep it out of the hands of agents scoped to a particular directory. You can use profiles as an agent guardrail by banning agents from using wrangler login/profiles commands, but setting a profile in the working directory. This will let the agent run commands attached to that account without requiring interactive login, but they shouldn't be able to switch accounts.

New commands

npx wrangler profiles create/delete - basically login/logout. intentionally keeping profiles separate from login/out, so if you run wrangler login/out with an active profile, they will error.

NOTE:
I'm not sure if the above is confusing or not, please yell if you think we should have something like npx wrangler login/out --profile=name. This would let you re-login to a profile, but also if you selected a specific account for the token, we can't preserve that when you run the auth flow again - footgun.

npx wrangler profiles set <name> —dir, where you can pass in a path or it defaults to cwd. Whenever you’re in that directory, wrangler will default to that profile. You can override this with the env var WRANGLER_PROFILE. (removed the --profile global flag for simplicity, we can it back in a followup if we really want)
npx wrangler profiles set <name> (without dir) sets a globally active profile. This applies to any unbound directories. This is useful if you deploy something to multiple accounts.
npx wrangler profiles unset (—dir) does the reverse
npx wrangler profiles list

TODO in follow up:

make it show what accounts each token is associated with in the list command

Tests
- Tests included/updated
- Automated tests not possible - manual testing has been completed as follows:
- Additional testing not necessary because:
Public documentation
- Cloudflare docs PR(s):
- Documentation not necessary because: TODO?

A picture of a cute animal (not mandatory, but encouraged)

changeset-bot · 2026-05-19T16:14:39Z

🦋 Changeset detected

Latest commit: a699560

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
wrangler	Minor
@cloudflare/vite-plugin	Patch
@cloudflare/vitest-pool-workers	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

workers-devprod · 2026-05-19T16:15:05Z

Codeowners approval required for this PR:

@cloudflare/cloudchamber
@cloudflare/wrangler

Show detailed file reviewers

.changeset/auth-profiles-support.md: [@cloudflare/wrangler]
packages/workers-utils/src/environment-variables/factory.ts: [@cloudflare/wrangler]
packages/wrangler/src/tests/artifacts.test.ts: [@cloudflare/wrangler]
packages/wrangler/src/tests/containers/registries.test.ts: [@cloudflare/cloudchamber @cloudflare/wrangler]
packages/wrangler/src/tests/index.test.ts: [@cloudflare/wrangler]
packages/wrangler/src/tests/logout.test.ts: [@cloudflare/wrangler]
packages/wrangler/src/tests/profile.test.ts: [@cloudflare/wrangler]
packages/wrangler/src/tests/user.test.ts: [@cloudflare/wrangler]
packages/wrangler/src/tests/vpc.test.ts: [@cloudflare/wrangler]
packages/wrangler/src/core/register-yargs-command.ts: [@cloudflare/wrangler]
packages/wrangler/src/core/types.ts: [@cloudflare/wrangler]
packages/wrangler/src/index.ts: [@cloudflare/wrangler]
packages/wrangler/src/user/auth-variables.ts: [@cloudflare/wrangler]
packages/wrangler/src/user/commands.ts: [@cloudflare/wrangler]
packages/wrangler/src/user/login-shared.ts: [@cloudflare/wrangler]
packages/wrangler/src/user/profiles.ts: [@cloudflare/wrangler]
packages/wrangler/src/user/user.ts: [@cloudflare/wrangler]
packages/wrangler/src/user/whoami.ts: [@cloudflare/wrangler]

github-actions · 2026-05-19T16:15:49Z

✅ All changesets look good

pkg-pr-new · 2026-05-19T16:37:19Z

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@13975

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@13975

miniflare

npm i https://pkg.pr.new/miniflare@13975

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@13975

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@13975

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@13975

@cloudflare/vitest-pool-workers

npm i https://pkg.pr.new/@cloudflare/vitest-pool-workers@13975

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@13975

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@13975

wrangler

npm i https://pkg.pr.new/wrangler@13975

commit: a699560

petebacondarwin · 2026-05-20T09:38:00Z

@emily-shen - looks like the Ci is not happy and there are some suggestions from Devin.

Allow users to be logged into multiple Cloudflare accounts simultaneously via named profiles stored as separate TOML files. - Add `wrangler profile list|use|delete` subcommands - Add `--profile` global flag and WRANGLER_PROFILE env var - Support `wrangler login --profile <name>` to store credentials - Namespace account cache per profile to prevent cross-contamination - Display active profile in `wrangler whoami` output Profile resolution priority: --profile flag > WRANGLER_PROFILE env > profiles.toml > "default" Profiles stored under ~/.wrangler/config/profiles/<name>.toml. Default profile path unchanged for full backward compatibility. Refs: #8956, #11513

Unify login handler to a single code path so the profile success message and metrics event fire regardless of --scopes usage. Fix profileExists, deleteProfile, and listProfiles to use environment-aware paths via getAuthConfigFilePath, so profiles created in staging are correctly found, listed, and deleted.

Validate WRANGLER_PROFILE and profiles.toml active_profile with validateProfileName() to prevent invalid profile names from being used in auth config file path construction. Also reinitialise auth tokens in clearProfileOverride() to keep cached credentials in sync when the active profile changes.

deleteProfile() previously used getActiveProfile() to check whether the deleted profile was active, but getActiveProfile() respects --profile and WRANGLER_PROFILE overrides. This meant profiles.toml could be left pointing at a deleted profile when a different override was active. Extract getActiveProfileFromConfig() to read profiles.toml directly, ignoring runtime overrides, and use it in deleteProfile().

- Add profile field to whoami --json test expectation - Update inline snapshots for experimental-commands-api and functions-build

- Add WRANGLER_PROFILE to VariableNames type in workers-utils - Fix "open-beta" -> "open beta" status enum in profile commands - Use expect from test context in profile.test.ts (lint rule)

emily-shen · 2026-05-21T09:39:04Z

 import type { ExpectStatic } from "vitest";

 describe("containers registries --help", () => {
+	runInTempDir();


have had to do this to a bunch of test files to make sure that running tests locally while you have a profile active doesn't contaminate the snapshots

devin-ai-integration

Devin Review found 1 new potential issue.

View 21 additional findings in Devin Review.

devin-ai-integration · 2026-05-21T13:35:27Z

+			const message = getProfileForDirectory()
+				? `This directory is bound to the auth profile "${currentProfile}"\n`
+				: `You are currently using the auth profile "${currentProfile}".\n`;


🟡 Login error message attributes wrong profile name to directory binding when WRANGLER_PROFILE overrides it

When both WRANGLER_PROFILE and a directory binding are set to different profiles, the error message is factually incorrect. getActiveProfileName() returns the env-var profile (highest priority), but the message checks getProfileForDirectory() to decide the message template and then substitutes currentProfile (from the env var). For example, if WRANGLER_PROFILE=env-profile and the directory is bound to dir-profile, the message says "This directory is bound to the auth profile 'env-profile'" — but the directory is actually bound to dir-profile.

Triggering scenario

Set WRANGLER_PROFILE=env-profile

Bind cwd to a different profile: wrangler profiles set dir-profile --dir .

Run wrangler login

Message incorrectly states: "This directory is bound to the auth profile 'env-profile'"

The fix is to use the return value of getProfileForDirectory() in the directory-binding message branch instead of currentProfile.

Suggested change

const message = getProfileForDirectory()

? `This directory is bound to the auth profile "${currentProfile}"\n`

: `You are currently using the auth profile "${currentProfile}".\n`;

const dirProfile = getProfileForDirectory();

const message = dirProfile

? `This directory is bound to the auth profile "${dirProfile}"\n`

: `You are currently using the auth profile "${currentProfile}".\n`;

Was this helpful? React with 👍 or 👎 to provide feedback.

emily-shen requested a review from workers-devprod as a code owner May 19, 2026 16:14

emily-shen force-pushed the emily/profiles branch from 2c9d214 to 1363e78 Compare May 19, 2026 16:14

workers-devprod requested review from a team and petebacondarwin and removed request for a team May 19, 2026 16:15

workers-devprod added this to workers-sdk May 19, 2026

github-project-automation Bot moved this to Untriaged in workers-sdk May 19, 2026

This comment was marked as resolved.

Sign in to view

petebacondarwin force-pushed the emily/profiles branch from 9800b0c to d13436f Compare May 20, 2026 09:38

petebacondarwin marked this pull request as draft May 20, 2026 09:38

petebacondarwin removed request for a team and petebacondarwin May 20, 2026 09:38

workers-devprod requested review from a team and penalosa and removed request for a team May 20, 2026 09:38

bimsonz added 7 commits May 20, 2026 11:24

fix(wrangler): update inline snapshots for --profile global flag

c5852ba

fix(wrangler): update test snapshots after rebase

349a928

- Add profile field to whoami --json test expectation - Update inline snapshots for experimental-commands-api and functions-build

fix(wrangler): address post-rebase type and lint issues

0135a83

- Add WRANGLER_PROFILE to VariableNames type in workers-utils - Fix "open-beta" -> "open beta" status enum in profile commands - Use expect from test context in profile.test.ts (lint rule)

remove --profile global flag

fb06ad1

emily-shen force-pushed the emily/profiles branch 2 times, most recently from 28a3ff7 to 206d263 Compare May 20, 2026 16:36

emily-shen marked this pull request as ready for review May 21, 2026 08:52

This comment was marked as resolved.

Sign in to view

emily-shen force-pushed the emily/profiles branch from 206d263 to d856697 Compare May 21, 2026 09:30

This comment was marked as resolved.

Sign in to view

emily-shen commented May 21, 2026

View reviewed changes

emily-shen force-pushed the emily/profiles branch from d856697 to ae58fb1 Compare May 21, 2026 09:44

emily-shen added 5 commits May 21, 2026 10:57

add/update profile commands and logic

b0a0093

print currently active profile on commands

90f4672

changeset

fdcb0d5

fix rebase

4252b41

revert incorrectly updated snapshots

1fc7b51

emily-shen force-pushed the emily/profiles branch 2 times, most recently from 3fbaf9d to bef712f Compare May 21, 2026 10:04

This comment was marked as resolved.

Sign in to view

emily-shen force-pushed the emily/profiles branch from bef712f to d674d6a Compare May 21, 2026 13:17

fixup tests and devin comments

a699560

emily-shen force-pushed the emily/profiles branch from d674d6a to a699560 Compare May 21, 2026 13:26

devin-ai-integration Bot reviewed May 21, 2026

View reviewed changes

Conversation

emily-shen commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

workers-devprod commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

pkg-pr-new Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

petebacondarwin commented May 20, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

emily-shen May 21, 2026

Choose a reason for hiding this comment

Uh oh!

This comment was marked as resolved.

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot May 21, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

emily-shen commented May 19, 2026 •

edited

Loading

changeset-bot Bot commented May 19, 2026 •

edited

Loading

workers-devprod commented May 19, 2026 •

edited

Loading

github-actions Bot commented May 19, 2026 •

edited

Loading

pkg-pr-new Bot commented May 19, 2026 •

edited

Loading