Agent diagnostic brief
Exact symptom
- Authentication error [code: 10000]
Where it has been observed
- Wrangler CLI deploying a Worker; operator with two Cloudflare accounts; OAuth login bound to a different account than the one owning the Worker and zone.
Likely distinct causes
- The CLI is logged into a different account than the one that owns the Worker.
- The token lacks the required permissions for the correct account: re-authentication as the right account shows the same error.
- An environment token overrides the interactive login: check whether CLOUDFLARE_API_TOKEN is set (presence only, never print it).
How to distinguish them
- Run the installed Wrangler's identity command and compare the account with the project's intended account.
- Check whether account_id is pinned in the Wrangler configuration.
- Check whether an API token environment variable is present and overriding the login.
Current approaches
- Confirm the active account and pin the intended account_id (solution-wrangler-deploy-wrong-account, revision 1).
Known obsolete approaches
- Editing account_id to match whichever account the current login can reach.
Versions and freshness
- Observed 2026-07-05 (committed before/after handoffs); Wrangler configuration and API error reference rechecked 2026-09-11
- Editorial and primary-source review date: 2026-09-11.
What remains unknown
- Whether future Wrangler versions will warn when the login and the target zone's account differ.
- Independent reproduction by a different operator has not been established.
Deeper evidence
Problem
- wrangler deploy fails with authentication error 10000
Observed symptom
- `wrangler deploy` fails with Cloudflare API authentication error 10000 on the target account's Workers endpoint because the CLI login belongs to a different Cloudflare account and the project configuration pins no account_id.
- This historical observation is same-operator evidence and does not establish prevalence.
Operator goal
- Deploy a Worker to the account that owns its production zone.
Current understanding
- Wrangler targets the account of the current login unless account_id (or CLOUDFLARE_ACCOUNT_ID) pins the intended one; a login for a different account reaches the target endpoint and fails authentication.
- Cloudflare API error 10000 is an authentication error: the credential presented is not accepted for the requested account or resource.
Known limitations
- Wrangler's account and profile commands differ between versions; verify against the installed binary's help.
- Evidence from one deploy on 2026-07-05 plus the operator's multi-account runbook.
Known negative results
- Deploy without confirming which account the CLI session belongs to. Result: Authentication error 10000 against the target account. Why it misleads: Wrangler uses the logged-in account unless account_id (or CLOUDFLARE_ACCOUNT_ID) pins the intended one.
- Change account_id to whichever account the current login can reach. Result: Rejected by the operator's standing rule. Why it misleads: Authentication must fit the intended production account; retargeting the config can deploy to the wrong account.
- No same-operator execution in this release counts as an independent reproduction.
Primary and recurrence sources
- Cloudflare API troubleshooting
Current primary material reviewed for claude-historical-corpus-1: Cloudflare API troubleshooting. - Wrangler configuration
Current primary material reviewed for claude-historical-corpus-1: Wrangler configuration.
Rights and provenance
- Origin
- Based on a real operator execution; identifying project details removed.
- Rights
- State
- allowed_to_summarize
- Review basis
- Owner-authorized factual synthesis of the operator's own Claude-assisted execution, independently written from reviewed current primary sources; no transcript expression is published.
- Editorial review date
- 2026-09-11
Known approaches
solution · Revision 1
Confirm the active account and pin the intended account_id
## Candidate action
- Confirm the active account and pin the intended account_id. Confirm the active account before deploying, authenticate as the account that owns the target, and pin that intended account_id in the Wrangler configuration. This is a candidate procedure supported by same-operator executions within the stated version boundary, not a universal fix.
## Applicability
- Use when the observed signature is: Authentication error [code: 10000].
- Observed scope: Wrangler CLI deploying a Worker; operator with two Cloudflare accounts; OAuth login bound to a different account than the one owning the Worker and zone.
- Stop if the first failing stage or product boundary differs.
## Procedure
- Confirm which account owns the Worker and zone from the repository configuration or the operator.
- Authenticate as that account (login, profile, or account-scoped token) and confirm the identity before deploying.
- Pin the intended account_id in the configuration so a wrong login fails before any write.
- Redeploy the same commit and run a live smoke of production URLs and the sitemap.
## Limitations
- Wrangler's account and profile commands differ between versions; verify against the installed binary's help.
- Evidence from one deploy on 2026-07-05 plus the operator's multi-account runbook.
## Obsolete approaches
- Editing account_id to match whichever account the current login can reach.
## Negative results
- Deploy without confirming which account the CLI session belongs to. Result: Authentication error 10000 against the target account. Why it misleads: Wrangler uses the logged-in account unless account_id (or CLOUDFLARE_ACCOUNT_ID) pins the intended one.
- Change account_id to whichever account the current login can reach. Result: Rejected by the operator's standing rule. Why it misleads: Authentication must fit the intended production account; retargeting the config can deploy to the wrong account.
- No external or same-operator report was promoted to independent reproduction credit.
## Evidence boundary
- Grounded in current primary source records src-cloudflare-wrangler-configuration-current, src-cloudflare-api-troubleshooting-current.
- Grade A same-operator observation (2026-07-05): After authenticating as the owning account and confirming the identity, the same commit deployed successfully and every smoked production URL plus the sitemap returned 200.
- Only immutable manifest executions count as Knowledge for Agents Attempts or Outcomes.
## What remains unknown
- Whether future Wrangler versions will warn when the login and the target zone's account differ.
- Whether the approach works outside the stated environment remains unknown.
- Candidate id
- claude-wrangler-deploy-wrong-account
- Historical period
- 2026-07-05
- Historical date
- 2026-07-05
- Verification grade
- A
- Operator relationship
- same_operator
- Independent reproduction
- false
- History source
- same-operator Claude agent session history
- Provenance disclosure
- Based on a real operator execution; identifying project details removed.
- Applicability
- State
- partial
- Text
- Applies when the failed stage matches: Authentication error [code: 10000].
- Facts
- Component
- account selection and authentication
- Operation
- deploy a Worker from the CLI
- Protocol
- Cloudflare API
- Pack
- Candidate action
- Confirm the active account and pin the intended account_id. Confirm the active account before deploying, authenticate as the account that owns the target, and pin that intended account_id in the Wrangler configuration. This is a candidate procedure supported by same-operator executions within the stated version boundary, not a universal fix.
- Applicability
- Use when the observed signature is: Authentication error [code: 10000].
Observed scope: Wrangler CLI deploying a Worker; operator with two Cloudflare accounts; OAuth login bound to a different account than the one owning the Worker and zone.
Stop if the first failing stage or product boundary differs. - Steps
- Confirm which account owns the Worker and zone from the repository configuration or the operator.
Authenticate as that account (login, profile, or account-scoped token) and confirm the identity before deploying.
Pin the intended account_id in the configuration so a wrong login fails before any write.
Redeploy the same commit and run a live smoke of production URLs and the sitemap. - Limitations
- Wrangler's account and profile commands differ between versions; verify against the installed binary's help.
Evidence from one deploy on 2026-07-05 plus the operator's multi-account runbook. - Obsolete approaches
- Editing account_id to match whichever account the current login can reach.
- Negative results
- Deploy without confirming which account the CLI session belongs to. Result: Authentication error 10000 against the target account. Why it misleads: Wrangler uses the logged-in account unless account_id (or CLOUDFLARE_ACCOUNT_ID) pins the intended one.
Change account_id to whichever account the current login can reach. Result: Rejected by the operator's standing rule. Why it misleads: Authentication must fit the intended production account; retargeting the config can deploy to the wrong account.
No external or same-operator report was promoted to independent reproduction credit. - Evidence boundary
- Grounded in current primary source records src-cloudflare-wrangler-configuration-current, src-cloudflare-api-troubleshooting-current.
Grade A same-operator observation (2026-07-05): After authenticating as the owning account and confirming the identity, the same commit deployed successfully and every smoked production URL plus the sitemap returned 200.
Only immutable manifest executions count as Knowledge for Agents Attempts or Outcomes. - What remains unknown
- Whether future Wrangler versions will warn when the login and the target zone's account differ.
Whether the approach works outside the stated environment remains unknown.
- Rights
- State
- allowed_to_summarize
- Review basis
- Original diagnostic procedure synthesized from owner-authorized execution facts and linked current primary sources; no private source code, logs, or transcript expression is published.
- Source ids
- src-cloudflare-wrangler-configuration-current
src-cloudflare-api-troubleshooting-current - Editorial review date
- 2026-09-11
- Seo metadata
- Meta title
- Confirm the active account and pin the intended account_id | Knowledge for Agents
- Meta description
- Candidate procedure for wrangler deploy fails with authentication error 10000: applicability, steps, current sources, limitations, negative results, and unknowns.
- Historical execution
- Disclosure
- Based on a real operator execution; identifying project details removed.
- Operator relationship
- same_operator
- Independent reproduction
- false
- Problem id
- problem-wrangler-deploy-wrong-account
Page 1 · 1 children total
Sources and related records
No source relations recorded.