Unable to use `wrangler login` for several days now

[alexturpin]

What versions & operating system are you using?

Mac OS 26.2, different browsers (Arc, Chrome and Firefox latest), different repos with different Wrangler versions (latest v4, 3.74.0)

Please provide a link to a minimal reproduction

Repo not applicable

Describe the Bug

I've been unable to login via wrangler CLI for several days now. Tried different browsers via --browser=false and pasting the URL myself.

I can hit the Cloudflare OAuth endpoint fine, but the redirect always goes to

http://localhost:8976/oauth/callback?error=invalid_scope&error_description=The+requested+scope+is+invalid%2C+unknown%2C+or+malformed%0A%0AThe+OAuth+2.0+Client+is+not+allowed+to+request+scope+%22account%3Aread... (all other scopes included)

The localhost page never loads to give an error or anything, all I see are blank pages forever, no prompts to accept.

Please provide any relevant error logs

--- 2026-01-21T17:56:49.191Z debug
🪵  Writing logs to "/Users/alexturpin/Library/Preferences/.wrangler/logs/wrangler-2026-01-21_17-56-49_089.log"
---

--- 2026-01-21T17:56:49.191Z debug
Metrics dispatcher: Posting data {"deviceId":"90f4b102-ba8e-4102-a9a8-68333e79cccc","event":"wrangler command started","timestamp":1769018209191,"properties":{"amplitude_session_id":1769018209190,"amplitude_event_id":0,"wranglerVersion":"4.59.3","wranglerMajorVersion":4,"wranglerMinorVersion":59,"wranglerPatchVersion":3,"osPlatform":"Mac OS","osVersion":"Darwin Kernel Version 25.2.0: Tue Nov 18 21:09:40 PST 2025; root:xnu-12377.61.12~1/RELEASE_ARM64_T6000","nodeVersion":20,"packageManager":"npm","isFirstUsage":false,"configFileType":"toml","isCI":false,"isPagesCI":false,"isWorkersCI":false,"isInteractive":true,"hasAssets":false,"argsUsed":[],"argsCombination":"","agent":null,"command":"wrangler login","args":{}}}
---

--- 2026-01-21T17:56:49.197Z debug
.env file not found at "/Users/alexturpin/src/xxx/.env.local". Continuing... For more details, refer to https://developers.cloudflare.com/workers/wrangler/system-environment-variables/
---

--- 2026-01-21T17:56:49.222Z log

 ⛅️ wrangler 4.59.3
───────────────────
---

--- 2026-01-21T17:56:49.231Z log
Attempting to login via OAuth...
---

--- 2026-01-21T17:56:49.233Z log
Visit this link to authenticate: https://dash.cloudflare.com/oauth2/auth?response_type=code&client_id=54d11594-84e4-41aa-b438-e81b8fa78ee7&redirect_uri=http%3A%2F%2Flocalhost%3A8976%2Foauth%2Fcallback&scope=account%3Aread%20user%3Aread%20workers%3Awrite%20workers_kv%3Awrite%20workers_routes%3Awrite%20workers_scripts%3Awrite%20workers_tail%3Aread%20d1%3Awrite%20pages%3Awrite%20zone%3Aread%20ssl_certs%3Awrite%20ai%3Awrite%20queues%3Awrite%20pipelines%3Awrite%20secrets_store%3Awrite%20containers%3Awrite%20cloudchamber%3Awrite%20connectivity%3Aadmin%20offline_access&state=84Q42VQWmXR04zvF5T_U~2wnDxjKSswm&code_challenge=7B5mWpbE4dcvCYzUreIHccxNn4J6r0YIGlIySsOyQUw&code_challenge_method=S256
---

--- 2026-01-21T17:59:38.383Z log

---

--- 2026-01-21T17:59:38.438Z error
✘ [ERROR] invalid_scope


---

--- 2026-01-21T17:59:38.439Z debug
Error: invalid_scope
    at toErrorClass (/Users/alexturpin/src/xxx/node_modules/wrangler/wrangler-dist/cli.js:122726:14)
    at isReturningFromAuthServer (/Users/alexturpin/src/xxx/node_modules/wrangler/wrangler-dist/cli.js:122748:11)
    at Server.<anonymous> (/Users/alexturpin/src/xxx/node_modules/wrangler/wrangler-dist/cli.js:123003:27)
    at Server.emit (node:events:514:28)
    at Server.emit (node:domain:488:12)
    at parserOnIncoming (node:_http_server:1143:12)
    at HTTPParser.parserOnHeadersComplete (node:_http_common:119:17)
---

--- 2026-01-21T17:59:38.439Z debug
Metrics dispatcher: Posting data {"deviceId":"90f4b102-ba8e-4102-a9a8-68333e79cccc","event":"wrangler command errored","timestamp":1769018378439,"properties":{"amplitude_session_id":1769018209190,"amplitude_event_id":1,"wranglerVersion":"4.59.3","wranglerMajorVersion":4,"wranglerMinorVersion":59,"wranglerPatchVersion":3,"osPlatform":"Mac OS","osVersion":"Darwin Kernel Version 25.2.0: Tue Nov 18 21:09:40 PST 2025; root:xnu-12377.61.12~1/RELEASE_ARM64_T6000","nodeVersion":20,"packageManager":"npm","isFirstUsage":false,"configFileType":"toml","isCI":false,"isPagesCI":false,"isWorkersCI":false,"isInteractive":true,"hasAssets":false,"argsUsed":[],"argsCombination":"","agent":null,"command":"wrangler login","args":{},"durationMs":169265,"durationSeconds":169.265,"durationMinutes":2.821083333333333,"errorType":"ErrorInvalidScope"}}
---

[edmundhung]

Sorry you're having trouble logging in! This is the only report we've received about this recently, so it seems like something specific to your environment or account rather than a widespread server issue.

A few things to try:

1. Clear your auth state by logging out and in again:

   wrangler logout
   wrangler login

2. Try in an incognito/private browser window when the OAuth page opens to rules out conflicts with existing Cloudflare sessions or browser extensions

3. Try from a different network if you're on a VPN or corporate network. some proxies/firewalls can interfere with OAuth redirects

4. Try logging in with a single scope to isolate whether it's a scope-specific issue:

   wrangler login --scopes user:read

   If this also fails, it's not about which scopes we're requesting.

Also, as you mentioned you're seeing "blank pages forever", can you share if you see any logs popping up on the browser console?

[alexturpin]

@edmundhung thank you, I appreciate the suggestions.

1. I had done that, but just tried again, same issue
2. Same issue in a Chrome incognito
3. I'm on home internet, but just tried tethering off my mobile internet, same issue
4. No luck either.

No console logs, but I can observe the network requests

First request goes to

https://dash.cloudflare.com/oauth2/auth?response_type=code&client_id=REDACTED_CLIENT_ID&redirect_uri=http://localhost:8976/oauth/callback&scope=account:read%2520user%253Aread%2520workers%253Awrite%2520workers_kv%253Awrite%2520workers_routes%253Awrite%2520workers_scripts%253Awrite%2520workers_tail%253Aread%2520d1%253Awrite%2520pages%253Awrite%2520zone%253Aread%2520ssl_certs%253Awrite%2520ai%253Awrite%2520queues%253Awrite%2520pipelines%253Awrite%2520offline_access&state=REDACTED_STATE&code_challenge=REDACTED_CODE_CHALLENGE&code_challenge_method=S256

Gets 302'd to

http://localhost:8976/oauth/callback?error=invalid_scope&error_description=The+requested+scope+is+invalid%2C+unknown%2C+or+malformed%0A%0AThe+OAuth+2.0+Client+is+not+allowed+to+request+scope+%22account%3Aread%2520user%253Aread%2520workers%253Awrite%2520workers_kv%253Awrite%2520workers_routes%253Awrite%2520workers_scripts%253Awrite%2520workers_tail%253Aread%2520d1%253Awrite%2520pages%253Awrite%2520zone%253Aread%2520ssl_certs%253Awrite%2520ai%253Awrite%2520queues%253Awrite%2520pipelines%253Awrite%2520offline_access%22.&error_hint=The+OAuth+2.0+Client+is+not+allowed+to+request+scope+%22account%3Aread%2520user%253Aread%2520workers%253Awrite%2520workers_kv%253Awrite%2520workers_routes%253Awrite%2520workers_scripts%253Awrite%2520workers_tail%253Aread%2520d1%253Awrite%2520pages%253Awrite%2520zone%253Aread%2520ssl_certs%253Awrite%2520ai%253Awrite%2520queues%253Awrite%2520pipelines%253Awrite%2520offline_access%22.&state=REDACTED_STATE

Which never loads

This is confusing because I have two different Cloudflare accounts with a Worker Pro plan that I could login to, but I never get to the point of picking an account either. And on different internet, different browsers, different Wrangler installations... Are there config / cache files anywhere else on Mac OS maybe?

[alexturpin]

I figured it out. It's my fault. I turned these two settings on in Velja, which apparently double encodes the URLs.

Sorry about that, and thanks for your time @edmundhung