Problems with authentication with cloudflare

[tionis]

I can't seem to authenticate against Cloudflare, and I'm getting interesting routing errors using e.g. d1 list:

denoflare d1 list --account-id (cfg store cloudflare/account_id) --api-token (cfg store cloudflare/token)
error: Uncaught (in promise) Error: listD1Databases failed: status=404, errors=7003 Could not route to /client/v4/accounts/Unknown%20subcommand/d1/database, perhaps your object identifier is invalid?
    at execute (https://raw.githubusercontent.com/skymethod/denoflare/master/common/cloudflare_api.ts:1888:15)
    at eventLoopTick (ext:core/01_core.js:168:7)
    at async listD1Databases (https://raw.githubusercontent.com/skymethod/denoflare/master/common/cloudflare_api.ts:1327:13)
    at async Object.list [as handler] (https://raw.githubusercontent.com/skymethod/denoflare/master/cli/cli_d1.ts:98:17)
    at async CliCommand.routeSubcommand (https://raw.githubusercontent.com/skymethod/denoflare/master/cli/cli_command.ts:104:13)
    at async Object.d1 [as handler] (https://raw.githubusercontent.com/skymethod/denoflare/master/cli/cli_d1.ts:86:5)
    at async CliCommand.routeSubcommand (https://raw.githubusercontent.com/skymethod/denoflare/master/cli/cli_command.ts:104:13)
    at async https://raw.githubusercontent.com/skymethod/denoflare/master/cli/cli.ts:41:5

also in the r2 api:

denoflare r2 list-buckets --account-id (cfg store cloudflare/account_id) --api-token (cfg store cloudflare/token)
error: Uncaught (in promise) Error: verifyToken failed: status=400, errors=6003 Invalid request headers
    at execute (https://raw.githubusercontent.com/skymethod/denoflare/master/common/cloudflare_api.ts:1888:15)
    at eventLoopTick (ext:core/01_core.js:168:7)
    at async verifyToken (https://raw.githubusercontent.com/skymethod/denoflare/master/common/cloudflare_api.ts:957:13)
    at async loadR2Options (https://raw.githubusercontent.com/skymethod/denoflare/master/cli/cli_r2.ts:88:25)
    at async Object.listBuckets [as handler] (https://raw.githubusercontent.com/skymethod/denoflare/master/cli/cli_r2_list_buckets.ts:19:41)
    at async CliCommand.routeSubcommand (https://raw.githubusercontent.com/skymethod/denoflare/master/cli/cli_command.ts:104:13)
    at async Object.r2 [as handler] (https://raw.githubusercontent.com/skymethod/denoflare/master/cli/cli_r2.ts:70:5)
    at async CliCommand.routeSubcommand (https://raw.githubusercontent.com/skymethod/denoflare/master/cli/cli_command.ts:104:13)
    at async https://raw.githubusercontent.com/skymethod/denoflare/master/cli/cli.ts:41:5

I've tried with several scoped tokens and the global api token.

[johnspurlock-skymethod]

that looks like maybe your (cfg store cloudflare/*) shell expansion isn't doing what you think it's doing?

try with a static value or env var to narrow it down

can also add --verbose to any command for more logging

[tionis]

I actually copied the wrong error and confused myself when trying to reproduce it. When fixing the command I get the actual request error:

> denoflare r2 list-buckets --account-id (cfg store get cloudflare/account_id) --api-token (cfg store get cloudflare/token) --verbose
loadConfig: path=undefined
Using account-id and api-token from options
error: Uncaught (in promise) Error: verifyToken failed: status=400, errors=6003 Invalid request headers
    at execute (https://raw.githubusercontent.com/skymethod/denoflare/master/common/cloudflare_api.ts:1888:15)
    at eventLoopTick (ext:core/01_core.js:168:7)
    at async verifyToken (https://raw.githubusercontent.com/skymethod/denoflare/master/common/cloudflare_api.ts:957:13)
    at async loadR2Options (https://raw.githubusercontent.com/skymethod/denoflare/master/cli/cli_r2.ts:88:25)
    at async Object.listBuckets [as handler] (https://raw.githubusercontent.com/skymethod/denoflare/master/cli/cli_r2_list_buckets.ts:19:41)
    at async CliCommand.routeSubcommand (https://raw.githubusercontent.com/skymethod/denoflare/master/cli/cli_command.ts:104:13)
    at async Object.r2 [as handler] (https://raw.githubusercontent.com/skymethod/denoflare/master/cli/cli_r2.ts:70:5)
    at async CliCommand.routeSubcommand (https://raw.githubusercontent.com/skymethod/denoflare/master/cli/cli_command.ts:104:13)
    at async https://raw.githubusercontent.com/skymethod/denoflare/master/cli/cli.ts:41:5

and

> denoflare d1 list --account-id (cfg store get cloudflare/account_id) --api-token (cfg store get cloudflare/token) --verbose
loadConfig: path=undefined
Using account-id and api-token from options
listD1Databases: GET https://api.cloudflare.com/client/v4/accounts/**censored**/d1/database
authorization: Bearer **censored**
400 https://api.cloudflare.com/client/v4/accounts/**censored**/d1/database
cf-auditlog-id: **censored**
cf-cache-status: DYNAMIC
cf-ray: **censored**-HAM
content-type: application/json
date: Sat, 10 Aug 2024 06:49:02 GMT
server: cloudflare
set-cookie: __cflb=**censored**; SameSite=Lax; path=/; expires=Sat, 10-Aug-24 09:19:03 GMT; HttpOnly
set-cookie: __cf_bm=**censored**; path=/; expires=Sat, 10-Aug-24 07:19:02 GMT; domain=.api.cloudflare.com; HttpOnly; Secure; SameSite=None
set-cookie: __cfruid=**censored**; path=/; domain=.api.cloudflare.com; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
{
  success: false,
  errors: [ { code: 10000, message: "Authentication error" } ]
}
error: Uncaught (in promise) Error: listD1Databases failed: status=400, errors=10000 Authentication error
    at execute (https://raw.githubusercontent.com/skymethod/denoflare/master/common/cloudflare_api.ts:1888:15)
    at eventLoopTick (ext:core/01_core.js:168:7)
    at async listD1Databases (https://raw.githubusercontent.com/skymethod/denoflare/master/common/cloudflare_api.ts:1327:13)
    at async Object.list [as handler] (https://raw.githubusercontent.com/skymethod/denoflare/master/cli/cli_d1.ts:98:17)
    at async CliCommand.routeSubcommand (https://raw.githubusercontent.com/skymethod/denoflare/master/cli/cli_command.ts:104:13)
    at async Object.d1 [as handler] (https://raw.githubusercontent.com/skymethod/denoflare/master/cli/cli_d1.ts:86:5)
    at async CliCommand.routeSubcommand (https://raw.githubusercontent.com/skymethod/denoflare/master/cli/cli_command.ts:104:13)
    at async https://raw.githubusercontent.com/skymethod/denoflare/master/cli/cli.ts:41:5

[tionis]

(This time I also tested it by using the tokens/account_id values directly to exclude the possibility of an error in this step)

[johnspurlock-skymethod]

Hmm, I'm using the same denoflare version as you (master) and I'm able to list just fine using your exact command line (--account-id and --api-token)

Since you seen to be getting the general "no access" cf error message, double-check your Cloudflare api token has access to D1

Here's mine for example:

[tionis]

That worked, it seems that the cloudflare global api key has not all permissions and the other token wasn't set up correctly.
Thanks for your time!