cloudflare / cloudflare/developer-platform
Containers deploy gives opaque 403 'Authentication error' when account is on Free plan
- Dominant language
- No language data
- Stars
- 1
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
## Summary
When deploying a Worker with `[[containers]]` config on a **Free plan** account, `wrangler deploy` returns a generic `ApiError: Forbidden` with `{ error: 'Authentication error' }` after the Docker image builds successfully. There's no indication that the actual issue is the account needs the **Workers Paid plan**.
## Steps to reproduce
1. Create a Cloudflare account on the Free plan
2. Configure `wrangler.toml` with a `[[containers]]` block
3. Create an API token with Workers Scripts Edit + Cloudflare Images Edit permissions
4. Run `wrangler deploy`
## Expected behavior
A clear error message like:
> "Containers requires the Workers Paid plan. Upgrade at https://dash.cloudflare.com/?to=/:account/workers/plans"
Or at minimum, mention "Containers" and "plan" in the error.
## Actual behavior
```
✘ [ERROR] ApiError: Forbidden
📎 It looks like you are authenticating Wrangler via a custom API token set in an environment variable.
Please ensure it has the correct permissions for this operation.
url: 'https://api.cloudflare.com/client/v4/accounts//containers/me',
status: 403,
statusText: 'Forbidden',
body: { error: 'Authentication error' },
```
The error suggests the API **token** is wrong, but the real issue is the **plan**. We spent significant time debugging token permissions (creating new tokens, adding various permission scopes) before discovering the plan requirement.
## Additional context
- The Docker image builds and tags successfully before the error occurs, so you don't hit this until the very end of a long build
- The "Cloudflare Images" permission in the token creator UI sounds like it might cover Containers, but it doesn't — this adds to the confusion
- wrangler 4.90.0
Contributor guide
Assessment
This issue has not been assessed yet.