API tokens do not work in config/default.toml

[Electroid]

When an API token (not OAuth token) is added to ~/.wrangler/config/default.toml, it is rejected and the user is prompted to login. We should accept the API token.

[threepointone]

This was a conscious decision iirc, since API tokens can be compromised and have a much longer life. You can use CF_API_TOKEN=token wrangler ... to use api tokens, ofc. Want to revisit this decision?

[petebacondarwin]

From looking at the logic in the code, this should already work.

The way to do it is to set the oauth_token to be the API token but then also to provide a long expiration_time such as "3021-12-31T23:59:59+00:00", which is basically all we are doing when we get the API token from the CLOUDFLARE_API_TOKEN environment variable.

For example:

oauth_token = "<API TOKEN>"
expiration_time = "3021-12-31T23:59:59+00:00"

[petebacondarwin]

But as @threepointone said, we don't really want to encourage people to edit the ~/.wrangler/config/default.toml file, since that is internal...

[petebacondarwin]

So we are going to implement wrangler login --api-token=<API_TOKEN> which will authenticate them in this way without having to touch that file.

Scratch that. After further discussions, for 2.0 we are not going to implement support for "logging in" via an API token.
The CLOUDFLARE_API_TOKEN environment variable is going to be the only way to use such a token for authentication.
This is the recommended approach for CI environments.

We are discussing with the wider Workers/IAM teams at Cloudflare as to whether we can make the OAuth login more fine grained to control what accounts/roles a particular user login is granted. But this will not be available for Wrangler 2.0 release.

The immediate change to be implemented is to give a better error message when a user has used Wrangler 1's config command to store an API token, instead of logging in via OAuth, and then tries to use the same configuration to authenticate in Wrangler 2.