wrangler deploy fails with Authentication error [code: 10000] after OAuth token expired

Problem

Deploying a Worker fails with 10000 even though wrangler was logged in before; refreshing the token manually also fails with invalid_grant.

Error (redacted / normalized)

✘ [ERROR] A request to the Cloudflare API (/accounts/.../workers/scripts/...) failed.
  Authentication error [code: 10000]

Applies when

wrangler 4.x, macOS, CLOUDFLARE_API_TOKEN exported in the shell from an earlier script

Confirm it is this problem

env | grep -c CLOUDFLARE_API_TOKEN → expect: 1 (the variable is set in this shell); after unset, npx wrangler whoami succeeds.

Not this when / boundary

If whoami fails even after unsetting, the refresh token itself is revoked → wrangler login. If the error is code: 10001, the token lacks a scope, not expired.

Root cause

An exported CLOUDFLARE_API_TOKEN (copied from wrangler's config) overrides wrangler's own OAuth refresh flow; once that copied token expires every call fails and wrangler never refreshes.

Fix

1. unset CLOUDFLARE_API_TOKEN in the shell running wrangler.
2. Run npx wrangler whoami — wrangler refreshes its OAuth token itself.
3. If the refresh token is also invalid, npx wrangler login once in a browser.

How to verify

npx wrangler whoami prints the account; deploy succeeds.

What did not work

POSTing to dash.cloudflare.com/oauth2/token with the stale refresh token; re-exporting the token read from default.toml.

Risks

None.

Verified scope

wrangler 4.x, 2026-10