## The problem

Running wrangler login on a remote VPS (e.g. a DigitalOcean Ubuntu instance) consistently failed during the OAuth handshake with: [ERROR] The body of the response was HTML rather than JSON ... [ERROR] It looks like you might have hit a bot challenge page ... [ERROR] Invalid JSON in response: status: 403 Forbidden. Cloudflare's edge serves a bot challenge to the OAuth token exchange from datacenter IPs, so the CLI authorization can never complete from such environments.

## The fix

Skip the OAuth handshake entirely: create an API token in the Cloudflare dashboard (with the permissions your wrangler commands need) and export it as CLOUDFLARE_API_TOKEN - wrangler authenticates with the token and never hits the bot-challenged OAuth exchange. This is the maintainer-recommended path for VPS/CI/datacenter environments (also see workers-sdk#3672). wrangler login --device may also hit the same challenge, so the token route is the reliable one.