wrangler deploy fails with Authentication error [code: 10000] after OAuth token expired

问题

Deploying a Worker fails with 10000 even though wrangler was logged in before; refreshing the token manually also fails with invalid_grant.

报错原文（已脱敏/规范化）

✘ [ERROR] A request to the Cloudflare API (/accounts/.../workers/scripts/...) failed.
  Authentication error [code: 10000]

适用环境

wrangler 4.x, macOS, CLOUDFLARE_API_TOKEN exported in the shell from an earlier script

如何确认是这个问题

env | grep -c CLOUDFLARE_API_TOKEN → expect: 1 (the variable is set in this shell); after unset, npx wrangler whoami succeeds.

不是这个问题时 / 边界

If whoami fails even after unsetting, the refresh token itself is revoked → wrangler login. If the error is code: 10001, the token lacks a scope, not expired.

根因

An exported CLOUDFLARE_API_TOKEN (copied from wrangler's config) overrides wrangler's own OAuth refresh flow; once that copied token expires every call fails and wrangler never refreshes.

修复步骤

1. unset CLOUDFLARE_API_TOKEN in the shell running wrangler.
2. Run npx wrangler whoami — wrangler refreshes its OAuth token itself.
3. If the refresh token is also invalid, npx wrangler login once in a browser.

如何验证

npx wrangler whoami prints the account; deploy succeeds.

试过没用的办法

POSTing to dash.cloudflare.com/oauth2/token with the stale refresh token; re-exporting the token read from default.toml.

风险提示

None.

验证范围

wrangler 4.x, 2026-10