Wrangler "You are not authenticated" / wrangler login in CI

By Kaveh Alemi·Latchkey

Wrangler found no stored OAuth session and no API token, so it asks you to run wrangler login. That command opens a browser and cannot complete on a CI runner. The fix is to set CLOUDFLARE_API_TOKEN so Wrangler skips the login flow entirely.

What this error means

A deploy step prints "You are not authenticated. Please run wrangler login." and exits, or hangs waiting for a browser that never opens on the runner.

✘ [ERROR] You are not authenticated. Please run `wrangler login`.

Common causes

No token in the environment on a headless runner

Without CLOUDFLARE_API_TOKEN, Wrangler falls back to interactive OAuth, which cannot run in CI, so it reports you as not authenticated.

A local .wrangler session that does not exist in CI

It works locally because you ran wrangler login once; the runner is fresh and has no cached OAuth credentials.

How to fix it

Authenticate with an API token, not login

1. Create a scoped API token in the Cloudflare dashboard.
2. Store it as a secret and expose it as CLOUDFLARE_API_TOKEN.
3. Remove any wrangler login step from the workflow.

- run: npx wrangler deploy
  env:
    CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
    CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

Use the official deploy action

The wrangler-action wires the token in for you and never triggers the interactive login.

- uses: cloudflare/wrangler-action@v3
  with:
    apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}

How to prevent it

• Never rely on wrangler login in automation; use a token.
• Keep the token in CI secrets, scoped to the deploy.
• Test the workflow on a clean checkout so a cached local session cannot hide the gap.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation