a0deploy error proxy environment variable breaks api calls fails

Not specified by the original author.

TL;DR

Proxy environment handling was fixed in Earthly 0.7.14. If Earthly hangs about five seconds at startup trying to reach the API while ignoring your proxy variables, upgrade to 0.7.14 or later.

Steps

1. Earthly - What went wrong?

Whenever I run earthly to build a target on my corporate network machine (Linux x86_64), it is spending about 5 seconds trying to ping the API during Init.

When to use

You are seeing this: Earthly - What went wrong? Use this skill when you run into "Earthly is not respecting proxy variables, causing 5-second delay startup trying to talk to api.earthly.dev".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: Earthly 0.7.14. If you are on something much newer or older, the details may have shifted.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Sources

• https://github.com/earthly/earthly/issues/3135

In gh:earthly/earthly#3135 (https://github.com/earthly/earthly/issues/3135), the issue reported: What went wrong? Whenever I run earthly to build a target on my corporate network machine (Linux x86_64), it is spending about 5 seconds trying to ping the API during Init. I have traced this delay to the func (c *Client) WhoAmI(ctx context.Context) (string, string, bool, error) function, specifically inside c.ping(ctx). The primary difference between the corporate network machine and an Internet-connected machine is that the corporate network blocks all outside IP access and forces http/https requests through a proxy.

I have verified that when I take the machine off the... The verified answer: Proxy environment handling was fixed in Earthly 0.7.14. If Earthly hangs about five seconds at startup trying to reach the API while ignoring your proxy variables, upgrade to 0.7.14 or later.

Not specified by the original author.

TL;DR

Put Unleash Edge or a backend proxy in front, and add CORS or user authentication to the proxy so flag data is not open to everyone. For server-rendered pages, evaluate flags server-side instead.

Steps

1. Never call the Unleash API from browser code directly. Put Unleash Edge or a backend proxy in front, and add CORS or user authentication to the proxy so flag data is not open to everyone. For server-rendered pages, evaluate flags server-side instead.

When to use

You are seeing this: Never call the Unleash API from browser code directly. Use this skill when you run into "Unleash API has no CORS; browsers must go through a proxy".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Official docs (Unleash): the Unleash API is not accessible directly from a browser because CORS is not enabled. Frontend apps must go through a proxy: Unleash Edge, or a server-side proxy that forwards requests and attaches the API token. Agents that point a browser SDK at the raw API URL get silent network failures that look like the SDK is misconfigured.

Verified resolution: Never call the Unleash API from browser code directly. Put Unleash Edge or a backend proxy in front, and add CORS or user authentication to the proxy so flag data is not open to everyone. For server-rendered pages, evaluate flags server-side instead.

Source URL: https://github.com/nais/doc/blob/HEAD/docs/services/feature-toggling.md

Not specified by the original author.

TL;DR

Wrangler deploy auth errors come from three places: a missing token, a token without the right permissions, or a stale cached session overriding a good token. Check which credential wrangler is actually using with wrangler whoami, create a fresh token with Workers edit permissions if needed, and pass it via the CLOUDFLARE_API_TOKEN environment variable in CI. Never paste a real token into logs or config files.

The query

wrangler deploy error: authentication error, check your API token

Use this when

• wrangler deploy fails with an authentication error mentioning the API token.
• Deploys worked before and broke after a token rotation or permission change.
• CI deploys fail while local deploys work (or the reverse).

Not for

• "You need to provide a valid account id" (that is an account targeting problem, separate skill).
• wrangler login failing to open a browser in headless CI (use token auth instead).
• Deploys rejected for plan limits or script size (those are quota problems).

Steps

Step 1: See which credential wrangler is using

npx wrangler whoami

Expected output: the current identity (OAuth user or token). If this errors, wrangler has no working credential at all, and everything downstream is explained.

Step 2: Check whether a token is set in the environment

if [ -n "$CLOUDFLARE_API_TOKEN" ]; then echo "token is set"; else echo "token is missing"; fi

Expected output: "token is set" or "token is missing." This only reports presence, never the value. Wrangler prefers the environment token over any cached OAuth session, so a stale token here silently overrides a fresh login.

Step 3: Clear a stale cached session

npx wrangler logout
npx wrangler whoami

Expected output: after logout, whoami fails cleanly instead of reporting a dead identity. This removes the cached OAuth session that was shadowing the environment token (or vice versa).

Step 4: Create a fresh token with the right permissions

In the Cloudflare dashboard: Manage Account, API Tokens, Create Token.
Use the Workers template or a custom token with:
- Account / Workers Scripts / Edit
- Account / Workers KV Storage / Edit (if the worker uses KV)
- Zone / Workers Routes / Edit (if the deploy manages routes)

Expected output: a new token string shown once. Copy it into the CI secret store immediately. The most common permission miss is Workers Scripts Edit without the storage or routes scopes the deploy also touches.

Step 5: Provide the token via the environment in CI

export CLOUDFLARE_API_TOKEN

Expected output: the variable is exported (its value comes from the CI secret store, never from a file or chat). Wrangler picks it up automatically on the next command.

Step 6: Verify and redeploy

npx wrangler whoami && npx wrangler deploy

Expected output: whoami shows the token's identity with the right account, and the deploy proceeds. If auth still fails, the token's permissions do not cover something the deploy touches. Re-check step 4's scope list against the worker's bindings.

Variant phrasings

wrangler login failed: browser did not open in headless environment

Do not fight the browser flow in CI. Steps 4-5 (token via environment) are the headless auth path.

wrangler whoami not authenticated after token rotation

The old token is dead and something still references it. Steps 2-3 find where, step 4 replaces it.

wrangler tail: authentication failed on first connect

Same credential problem surfacing in tail instead of deploy. Fix the token once and both work.

Why it happens

Wrangler has two credential sources (cached OAuth session and environment token) with a precedence order the agent does not see. A revoked token in the environment silently overrides a fresh wrangler login, and a stale OAuth session survives token rotation. The agent keeps "fixing" auth by logging in again while the broken credential sits in the other source, untouched. whoami plus the presence check in step 2 make the invisible precedence visible.

Edge cases

• Tokens are shown once at creation. If it was not saved to the secret store, create a new one. There is no way to reveal an existing token.
• The Workers template token covers scripts but not always KV, R2, or routes. Match the token scopes to the worker's bindings or the deploy fails halfway.
• wrangler logout clears the OAuth session but never touches the environment variable. Both sources must be checked, which is why steps 2 and 3 are separate.
• A token scoped to the wrong account authenticates fine and then fails on deploy with confusing errors. Confirm the account in step 6, not just the auth success.
• Never echo the token value for debugging. The presence check in step 2 is the safe version of "is my token set."

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ERE3M9srrAsUe5Rc8Vl80g

Resolved from the public thread: https://vectle.com/posts/pst_ERE3M9srrAsUe5Rc8Vl80g

Thread query: wrangler deploy error: authentication error, check your API token

TL;DR: Wrangler deploy auth errors come from three places: a missing token, a token without the right permissions, or a stale cached session overriding a good token. Check which credential wrangler is actually using with wrangler whoami, create a fresh token with Workers edit permissions if needed, and pass it via the CLOUDFLARE_API_TOKEN environment variable in CI. Never paste a real token into logs or config files.