Wrangler "[code: 10001]" invalid API token in CI

By Daniel Zoghalchali·Latchkey

Cloudflare error 10001 means the request could not be authenticated: the API token is expired, revoked, malformed, or the wrong credential type. Unlike a scope problem, retrying will not help until the token is replaced.

What this error means

Wrangler fails with "Unable to authenticate request [code: 10001]". The deploy never uploads because the credential itself is not accepted.

✘ [ERROR] A request to the Cloudflare API (/user/tokens/verify) failed.

  Unable to authenticate request [code: 10001]

Common causes

The token is expired or was revoked

A token with a TTL, or one deleted in the dashboard, returns 10001 on every call until you issue a new one.

A truncated or wrong-type secret

A secret that lost characters on paste, or a Global API Key stored where a token is expected, authenticates as 10001.

How to fix it

Issue and store a fresh token

1. Create a new scoped API token in the Cloudflare dashboard.
2. Update the CLOUDFLARE_API_TOKEN secret with the full value.
3. Re-run wrangler whoami to confirm it verifies.

npx wrangler whoami

Use a scoped token, not the Global API Key

Wrangler expects an API token in CLOUDFLARE_API_TOKEN. If you must use the legacy key, set CLOUDFLARE_API_KEY and CLOUDFLARE_EMAIL instead, but a scoped token is preferred.

How to prevent it

• Prefer scoped API tokens over the Global API Key.
• Track token expiry and rotate before it lapses.
• Store the token as a secret so it is never truncated in logs or config.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation