Wrangler "Authentication error [code: 10000]" in CI

By Daniel Zoghalchali·Latchkey

Cloudflare returned API error 10000, which means the credential Wrangler sent was missing, invalid, or lacked the required scope. In CI you almost always fix it by setting a valid CLOUDFLARE_API_TOKEN secret, not by running wrangler login.

What this error means

A wrangler deploy step fails immediately with "Authentication error [code: 10000]" before uploading anything. Interactive wrangler login is impossible on a headless runner, so the token is the only option.

✘ [ERROR] A request to the Cloudflare API (/accounts/.../workers/scripts/app) failed.

  Authentication error [code: 10000]

Common causes

No API token is exposed to the job

Wrangler looks for CLOUDFLARE_API_TOKEN in the environment. If the secret was never set or not mapped into the step env, Wrangler sends an unauthenticated request and Cloudflare replies 10000.

The token is malformed or lacks Workers scope

A truncated token, or one created without the "Edit Cloudflare Workers" permission, authenticates as invalid and returns the same 10000 code.

How to fix it

Set CLOUDFLARE_API_TOKEN from a secret

1. Create a scoped API token in the Cloudflare dashboard with "Edit Cloudflare Workers".
2. Store it as a repository or organization secret.
3. Map it into the deploy step env as CLOUDFLARE_API_TOKEN.

- name: Deploy
  run: npx wrangler deploy
  env:
    CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

Verify the token before deploying

A quick wrangler whoami confirms the token authenticates and shows the account it maps to, so you catch a bad token before the deploy step.

npx wrangler whoami

How to prevent it

• Store the token in CI secrets and reference it as CLOUDFLARE_API_TOKEN, never wrangler login.
• Scope the token to only the Workers permissions the deploy needs.
• Rotate the token on a schedule and update the secret in one place.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation