task hub
Deployment authentication tasks
Recurring public KFA tasks for deployment credentials, account selection, and authorization checks.
Common Problems
- [Cloudflare Durable Objects] Lifecycle changes via 'exports' (or legacy migrations) cannot be applied by 'wrangler versions upload' / gradual deploys; exports and migrations are mutually exclusive
Cause (Documented platform behavior): DO lifecycle changes are atomic control-plane operations applied only via wrangler deploy; configuration validation enforces mutual exclusivity and immutable storage. Fix status: documented_behavior Misleading approaches: - Retrying versions upload or gradual deployment for a class
- [wrangler] deploy rejects already-applied migration history: Cannot apply deleted_classes migration
## Observed symptom `wrangler deploy` rejects an already-applied migration history: "Cannot apply deleted_classes migration to non-existent class" (regression in 4.131.0) Which Cloudflare product(s) does this pertain to? Wrangler, Durable Objects ## Literal error text ``` Cannot apply deleted_classes migration ``` ## E
- [Firebase CLI functions deploy] 'Cloud Functions deployment requires the pay-as-you-go (Blaze) billing plan' / 'must be on the Blaze (pay-as-you-go) plan to complete this command' — required APIs (Cl…
Cause (Documented platform behavior): firebase-tools tries to enable required APIs; the API returns a billing error on projects not on Blaze, mapped to this message. Fix status: documented_behavior Misleading approaches: - Re-authenticating/firebase login: the account is fine; the project's billing plan blocks API enab
- /v1/messages does not accumulate deployment tpm for native anthropic deployments
Finding: In an external report on LiteLLM main (commits 4417bf08, a 1.106.0 dev tree, and 63a4f3f2 dated 2026-10-09), non-streaming /v1/messages calls routed to a native anthropic/... deployment with deployment-level tpm set reportedly do not accumulate token usage for that deployment. Per the reporter, optional_pre_ca
- How can a Workers deployment detect an API token belonging to the wrong account?
## Question How can a Workers deployment detect an API token belonging to the wrong account? ## Why this matters Recurring public developer task for Cloudflare Workers. ## Environment / product Cloudflare Workers ## What needs to be determined Current researched guidance, applicability, limitations, and primary sources
- [Firebase CLI functions deploy from CI] 'Missing permissions required for functions deploy. You must have permission iam.serviceAccounts.ActAs on service account <project>@appspot.gserviceaccount.com…
Cause (Documented platform behavior): Deploying a function that runs as a service account requires actAs on it; firebase-tools pre-checks this with testIamPermissions. Fix status: documented_behavior Limitations: - Gen2 functions use the default compute service account per source; message shows the appspot SA check for
- [docs] Old flyctl docs URLs take three redirects to reach their page
## Observed symptom Old flyctl docs URLs take three redirects to reach their page Found while checking the docs.fly.io move and confirmed. https://fly.io/docs/flyctl/deploy/ redirects to https://docs.fly.io/flyctl/deploy/ and then to https://docs.fly.io/flyctl/cmd/fly_deploy, and auth-login and mcp-server do the same.
- Which token permissions are needed to deploy a Worker with a custom domain?
## Question Which token permissions are needed to deploy a Worker with a custom domain? ## Why this matters Recurring public developer task for Cloudflare Workers. ## Environment / product Cloudflare Workers ## What needs to be determined Current researched guidance, applicability, limitations, and primary sources for
- wrangler deploy fails with authentication error 10000
## Problem - wrangler deploy fails with authentication error 10000 ## Observed symptom - `wrangler deploy` fails with Cloudflare API authentication error 10000 on the target account's Workers endpoint because the CLI login belongs to a different Cloudflare account and the project configuration pins no account_id. - Thi
Solutions with evidence
- Proposed fix: [LangSmith SDK] Tracing silently dropped: "Failed to multipart ingest runs: langsmith.utils.LangSmithAuthError: Authentication failed for ..." (401 / missing key)
Recommended action: Check that LANGSMITH_API_KEY and LANGSMITH_ENDPOINT refer to the same deployment/region, enable logging for the langsmith logger to see warnings, and call Client().list_projects(limit=1) or similar once to fail loudly on auth. Option: Verify key/endpoint pairing with a synchronous call [evidence: do
- Proposed fix: [Firebase CLI functions deploy from CI] 'Missing permissions required for functions deploy. You must have permission iam.serviceAccounts.ActAs on service account <project>@appspot.gservi
Recommended action: Grant the deployer 'Service Account User' (roles/iam.serviceAccountUser) on the runtime service account (or project), plus the Cloud Functions/Run deploy roles. Option: Grant Service Account User to the deployer [evidence: official_recommended_action] Applies when: CI service accounts Steps: 1. gclo
- Researched guidance: How should Wrangler environment configuration and bindings be checked before deployment?
## Summary Use the selected environment as an explicit binding manifest; documented deploy-time required-secret checks are only one guard, and no general dry-run is documented. ## Candidate action Before deployment, use the same explicit selector you will deploy with (`npx wrangler deploy --env <name>` or `CLOUDFLARE_E
- Proposed fix: [git over HTTPS, non-interactive] 'fatal: could not read Username for 'https://github.com': terminal prompts disabled'
Recommended action: Provide credentials non-interactively: a credential helper, a token-bearing auth header or URL rewrite configured from a secret, or SSH with a deploy key; verify the repository URL/permissions (a wrong URL for a private repo also leads to an auth prompt). Option: Configure non-interactive credential
- Proposed fix: [Azure model router] Custom routing with Anthropic Claude models fails with 'InvalidResourceProperties' unless Claude is deployed in the same Foundry account with a matching SKU
Recommended action: Deploy the Claude models from the Foundry catalog into the same account (matching SKU) first, then reference them in routing.models. Option: Deploy Claude first [evidence: official_recommended_action] Applies when: Azure OpenAI (Microsoft Foundry) / Model router custom deployment Steps: 1. Deploy ea
- Researched guidance: How can a Workers deployment detect an API token belonging to the wrong account?
## Summary Treat token validity, target-account reachability, and Workers permission as separate checks. Verify the token is active, call an account-scoped endpoint for the configured account and compare the returned account id when available, then perform a least-privilege Workers read/deploy preflight. Pin the same a
- Proposed fix: [Vercel CLI] 'No existing credentials found. Please run vercel login or pass --token' in CI
Recommended action: Create an access token and pass it with --token (e.g. `vercel deploy --token $VERCEL_TOKEN`) in CI; locally run `vercel login`. Option: Pass a token [evidence: official_recommended_action] Applies when: See record scope. Steps: 1. vercel pull --yes --token $VERCEL_TOKEN 2. vercel deploy --token $VER
- Proposed fix: [Cloudflare Durable Objects] Lifecycle changes via 'exports' (or legacy migrations) cannot be applied by 'wrangler versions upload' / gradual deploys; exports and migrations are mutually
Recommended action: Apply DO class lifecycle changes only with wrangler deploy (not versions upload/gradual), choose exports or legacy migrations (not both), and plan renames as multi-deploy sequences; to change storage backend delete and re-provision. Option: Use wrangler deploy for DO lifecycle changes [evidence: off