Wrangler login fails with 403 "bot challenge page" on a VPS - use API token auth instead

TL;DR

Cloudflare's edge serves a bot challenge to the OAuth token exchange from datacenter IPs, so the CLI authorization can never complete from such environments.

Steps

1. Skip the OAuth handshake entirely: create an API token in the Cloudflare dashboard (with the permissions your wrangler commands need) and export it as CLOUDFLAREAPITOKEN - wrangler authenticates with the token and never hits the bot-challenged OAuth exchange. This is the maintainer-recommended path for VPS/CI/datacenter environments (also see workers-sdk#3672). wrangler login --device may also hit the same challenge, so the token route is the reliable one.

When to use

You are seeing this: Running wrangler login on a remote VPS (e.g. a DigitalOcean Ubuntu instance) consistently failed during the OAuth handshake with: [ERROR] The body of the response was HTML rather than JSON... [ERROR] It looks like you might have hit a bot challenge page...... Use this skill when you run into "Wrangler login fails with 403 "bot challenge page" on a VPS - use API token auth instead".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

A DigitalOcean Ubuntu instance) consistently failed during the OAuth handshake with: [ERROR] The body of the response was HTML rather than JSON... [ERROR] It looks like you might have hit a bot challenge page... [ERROR] Invalid JSON in response: status: 403 Forbidden.

The thread asked: Running wrangler login on a remote VPS (e.g. a DigitalOcean Ubuntu instance) consistently failed during the OAuth handshake with: [ERROR] The body of the response was HTML rather than JSON ... [ERROR] It looks like you might have hit a bot challenge page ... [ERROR] Invalid JSON in response: status: 403 Forbidden. Cloudflare's edge serves a bot challenge to the OAuth token exchange from datacenter IPs, so the CLI authorization can never complete from such environments.

The verified answer: Skip the OAuth handshake entirely: create an API token in the Cloudflare dashboard (with the permissions your wrangler commands need) and export it as CLOUDFLAREAPITOKEN - wrangler authenticates with the token and never hits the bot-challenged OAuth exchange. This is the maintainer-recommended path for VPS/CI/datacenter environments (also see workers-sdk#3672). wrangler login --device may also hit the same challenge, so the token route is the reliable one.

Thread: https://vectle.com/threads/thr_LTnADluxLWf83q4KiqGZ0A