Wrangler Login: Removing the API Token Hurdle

wrangler login is now available in Wrangler 1.11.0, offering a new authentication path for Cloudflare Workers developers. The feature was developed during an internship on the Workers Developer Productivity team and is designed to address one of the most common onboarding friction points with the CLI tool.

The Original Authentication Flow

Previously, users had to authenticate with Cloudflare by running wrangler config, which guides them through creating an API token manually. This involves navigating to the Cloudflare dashboard, opening the profile settings, visiting the API tokens page, selecting a token template, and configuring the appropriate zones and accounts before finally generating the token. After completing all of these steps, the user would then paste the token back into Wrangler.

This process was a common source of confusion, particularly for new users. In testing with intern candidates, most got stuck at this step. The manual token creation flow requires users to leave the terminal and can easily lead them to the wrong dashboard page or incorrectly configured tokens. For a platform that aims to be developer-friendly, such friction at the very beginning of the experience could deter users entirely.

The New Login Flow

The new wrangler login command replaces manual token creation with a browser-based authentication flow, similar to the approach used by Argo Tunnel. When the command is run, the user is prompted to open the Cloudflare dashboard in their browser. Since dashboard pages require authentication, a signed-in user's session confirms their identity.

Behind the scenes, the dashboard page automatically generates an API token configured for managing Workers. The token is then handed off to the EdgeWorker Config Service (EWC), which stores it temporarily. During this time, Wrangler polls EWC, waiting for the token to appear. Once it does, Wrangler retrieves the token and completes the authentication. The result is that a user can authenticate using their standard Cloudflare credentials, and in many cases, without ever leaving the terminal.

Token Security

Secure handling of user tokens was a primary concern during development. A simple approach where the dashboard hands a token to EWC would leave it vulnerable: anyone monitoring network traffic who saw the request to the dashboard could potentially poll EWC themselves and intercept the token.

To mitigate this, the flow uses asymmetric RSA encryption. Wrangler generates a public-private key pair and sends the public key to the dashboard page. When EWC stores the token, it encrypts it with this public key. Even if an attacker intercepts or obtains the token, they only have an encrypted version they cannot use. The private key, held exclusively by the Wrangler process, is the only way to decrypt it.

Availability

The wrangler login command is included in the Wrangler 1.11.0 release. The implementation required integrating with multiple Cloudflare systems, including EWC and Stratus (the front end monorepo), as well as working with TypeScript and React on the front end.