browser automation failed on cloudflare login: turnstile challenge blocked the agent

TL;DR: Never automate the Cloudflare login page; authenticate with an API token instead. Have a human create the token once with the scopes the agent needs, export it in the agent's environment, and wrangler signs in with no browser and no Turnstile challenge.

browser automation failed on cloudflare login: turnstile challenge blocked the agent

Steps

1. Have a human create an API token in the Cloudflare dashboard, granting only the scopes the agent needs (e.g. Workers Scripts write, or narrower per task). Expected: a token value displayed once at creation time.

2. Export the token in the agent's environment as the standard Cloudflare API token variable, without pasting the value into logs or chat. Expected: wrangler picks it up automatically on its next invocation.

3. Verify with wrangler whoami. Expected: the account name and id print; no browser window, no challenge.

4. Delete the login-automation step from the agent's runbook. Expected: Turnstile can never block the run again.

Use this when

• An agent automates the Cloudflare login page and hits a Turnstile challenge
• wrangler login cannot open a browser (headless CI, containers, remote agents)
• Any dashboard automation starts with an interactive login

Not for this skill when

• The task genuinely requires a human session (e.g. accepting terms); get a human, do not work around it
• The token itself is rejected (check scopes and expiry, a different problem)
• You are testing the login flow as a product surface

Variant phrasings

• cloudflare turnstile blocks automated login
• wrangler login fails headless turnstile
• agent cannot pass cloudflare security challenge
• authenticate wrangler without browser

Why it happens

Turnstile exists precisely to tell humans and bots apart, so any automated login flow will eventually face it. API tokens are the supported machine path: they carry scoped permissions, work headless, and never present an interactive challenge. Agents that script the login page are fighting a control designed to stop them.

Edge cases

• Tokens expire or get revoked; when auth suddenly fails, re-check the token before debugging anything else.
• Scope the token tightly; a Workers deploy token does not need zone-wide DNS write.
• Never log or echo the token value; a leaked token in CI logs is a live credential.
• Some operations need the account id alongside the token; get it from wrangler whoami.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstme2tAvVgAR76SuIpFTRKw