cloudflare / cloudflare/workers-sdk
Bug: `wrangler auth create <profile>` never starts the OAuth callback server — login hangs forever
- Dominant language
- TypeScript
- Stars
- 4.5k
- Forks
- 1.5k
- Avg merge
- 3d 8h
- Merged PRs (30d)
- 186
Description
### What versions & OS?
- wrangler **4.125.0**
- Ubuntu 24.04 (WSL2), zsh/bash interactive terminal
### What happened?
`wrangler auth create ` prints *"Opening a link in your default browser"* and then waits forever. The browser authorize step completes, but the redirect to `http://localhost:8976/oauth/callback` never lands because **nothing is listening on port 8976**.
Verified while the command was still waiting:
```
$ ss -tln | grep 8976
(no output)
```
In contrast, plain `wrangler login` in the same environment correctly binds `127.0.0.1:8976`, the callback lands, and auth succeeds. So the experimental `auth create` path fails to start (or tears down) its local callback server before/at the point the browser flow begins.
### Expected behavior
While `wrangler auth create ` waits for the OAuth redirect, it should be listening on `localhost:8976/oauth/callback` so the authorization code can be exchanged and saved to the named profile.
### Actual behavior
Command blocks indefinitely after printing the auth URL; no listener exists on 8976; token is never saved.
### Workaround
Use plain login targeted at the profile:
```bash
WRANGLER_PROFILE= wrangler login
# or
wrangler login --profile
```
Both land the token in the named profile and work reliably here.
### Extra context
This makes `auth create` (the only documented way to *create* a non-default profile credential) unusable, while `login --profile` — which the warning text does not mention — actually works. Reproduced consistently across multiple attempts.
Contributor guide
Research direction
Start at the `wrangler auth create ` entry point and compare its OAuth flow with the working `wrangler login` path, using the reported `localhost:8976/oauth/callback` listener as the first check. Done means the command listens during authorization, receives the redirect, exchanges the code, and saves the token to the named profile.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication, cli
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100