cloudflare / cloudflare/workers-sdk

Bug: `wrangler auth create <profile>` never starts the OAuth callback server — login hangs forever

Open
#15,369 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
4.5k
Forks
1.5k
Avg merge
3d 8h
Merged PRs (30d)
186

Description

### What versions & OS?

- wrangler **4.125.0**
- Ubuntu 24.04 (WSL2), zsh/bash interactive terminal

### What happened?

`wrangler auth create ` prints *"Opening a link in your default browser"* and then waits forever. The browser authorize step completes, but the redirect to `http://localhost:8976/oauth/callback` never lands because **nothing is listening on port 8976**.

Verified while the command was still waiting:

```
$ ss -tln | grep 8976
(no output)
```

In contrast, plain `wrangler login` in the same environment correctly binds `127.0.0.1:8976`, the callback lands, and auth succeeds. So the experimental `auth create` path fails to start (or tears down) its local callback server before/at the point the browser flow begins.

### Expected behavior

While `wrangler auth create ` waits for the OAuth redirect, it should be listening on `localhost:8976/oauth/callback` so the authorization code can be exchanged and saved to the named profile.

### Actual behavior

Command blocks indefinitely after printing the auth URL; no listener exists on 8976; token is never saved.

### Workaround

Use plain login targeted at the profile:

```bash
WRANGLER_PROFILE= wrangler login
# or
wrangler login --profile
```

Both land the token in the named profile and work reliably here.

### Extra context

This makes `auth create` (the only documented way to *create* a non-default profile credential) unusable, while `login --profile` — which the warning text does not mention — actually works. Reproduced consistently across multiple attempts.

Contributor guide

Open the contributing guide

Research direction

Start at the `wrangler auth create ` entry point and compare its OAuth flow with the working `wrangler login` path, using the reported `localhost:8976/oauth/callback` listener as the first check. Done means the command listens during authorization, receives the redirect, exchanges the code, and saves the token to the named profile.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication, cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.