wrangler d1 migrations apply --remote --temporary fails with 'already authenticated' even with no prior login

[vladimirbakalov]

What version of Wrangler are you using?

4.122.0

What operating system are you using?

macOS

Describe the Bug

wrangler d1 migrations apply --remote --temporary fails with:

X [ERROR] You're already authenticated with Cloudflare, so `--temporary` can't be used. Temporary preview accounts are only for unauthenticated use. Either remove `--temporary` to use your existing account, or log out (and unset CLOUDFLARE_API_TOKEN) first.

...even when the only prior interaction with --temporary in the session was wrangler d1 create <name> --temporary and wrangler kv namespace create <name> --temporary, run against a freshly-created temp preview account (no wrangler login was ever run, and CLOUDFLARE_API_TOKEN/CLOUDFLARE_ACCOUNT_ID were not set in the environment).

The auth check for d1 migrations apply appears to treat the cached temp-account credential file at ~/Library/Preferences/.wrangler/wrangler-temporary-account.toml (written by earlier --temporary commands in the same session) as evidence of a real login, and refuses to proceed — even though --temporary is explicitly passed on this exact invocation and no real wrangler login ever happened.

Steps to reproduce

1. In a clean environment with no prior wrangler login and no CLOUDFLARE_API_TOKEN/CLOUDFLARE_ACCOUNT_ID set:

   wrangler deploy --temporary
   

   (accept the resulting temp preview account claim)
2. Create a D1 database against the same temp account:

   wrangler d1 create my-db --temporary
   

3. Apply migrations to that database, still passing --temporary:

   wrangler d1 migrations apply my-db --remote --temporary
   

Expected

Migrations apply against the temp preview account's D1 instance, same as the create/deploy commands did.

Actual

Fails immediately with You're already authenticated with Cloudflare, so --temporary can't be used, even though no real login exists — only cached temp-account state from steps 1-2 in the same session.

Workaround found

Extract account.id and apiToken from the cached ~/Library/Preferences/.wrangler/wrangler-temporary-account.toml, export them as CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN, then run the migrations command without --temporary:

export CLOUDFLARE_ACCOUNT_ID=<account.id from the toml file>
export CLOUDFLARE_API_TOKEN=<apiToken from the toml file>
wrangler d1 migrations apply my-db --remote

This applies cleanly against the real remote D1 instance tied to the temp account. It works, but it means --temporary is functionally unsupported for the d1 migrations apply --remote subcommand specifically, unlike d1 create, kv namespace create, and deploy, which all correctly accept --temporary in the same session.

Relevant code

The check appears to live around wrangler-dist/cli.js's "already authenticated" telemetry message (user temporary account already authenticated), which doesn't seem to special-case d1 migrations apply's own --temporary flag the way sibling commands do.

[workers-devprod]

Note

This is an automated, advisory triage report generated by workers-devprod. It is not an official maintainer response — a maintainer will follow up.

🤖 Automated triage report

Issue Triage: #15171

Summary

wrangler d1 migrations apply --remote --temporary incorrectly rejects the --temporary flag, treating a cached temp-preview-account credential from earlier --temporary commands as evidence of a real login.

Classification

• Type: Bug
• Component: packages/wrangler
• Severity: Medium
• Has Reproduction: Yes (clear step-by-step repro)
• Quality: Complete

Findings

• Created: not available (metadata not captured in context.json)
• Author: vladimirbakalov
• Version: 4.122.0
• Labels: not available
• Comments: not available

Analysis

• The report is well-structured and follows the bug template: it includes the Wrangler version (4.122.0), OS (macOS), a full error message, expected vs. actual behavior, and precise reproduction steps.
• Clear component mapping: this is a Wrangler CLI issue in the d1 migrations apply command's authentication/--temporary handling. D1 command code lives in packages/wrangler.
• Root-cause hypothesis (reporter's, plausible): the --temporary auth guard for d1 migrations apply interprets the cached temp-account credential file (~/Library/Preferences/.wrangler/wrangler-temporary-account.toml) written by prior --temporary invocations as a real authenticated session, and therefore refuses the flag. Other --temporary commands (deploy, d1 create, kv namespace create) work against the same temp account, indicating an inconsistency in how this specific command validates the flag.
• Severity is Medium: it blocks a legitimate temp-preview workflow (applying migrations against a temp account) with no obvious workaround, but temp preview accounts are a niche/onboarding feature and do not affect authenticated production users.
• The source tree (packages/) is not present in this checkout, so the exact guard could not be located; difficulty is estimated from the described behavior. The fix likely involves making the --temporary check consistent across commands (treating the temp-account credential as compatible with --temporary rather than as a real login) — a small, targeted change if the hypothesis holds.

Recommendation

Status: KEEP OPEN

Reasoning: This is a complete, actionable bug report with a clear reproduction and a plausible root cause in Wrangler's --temporary auth check for d1 migrations apply. It appears to be a genuine inconsistency across --temporary-supporting commands.

Action: Route to a Wrangler maintainer to verify the --temporary auth guard in the d1 migrations apply code path against the temp-account credential file and align it with the behavior of deploy / d1 create / kv namespace create.

Suggested Labels: (none — repository label set could not be confirmed from the available data)

Suggested Comment

Thanks for the detailed report and clear reproduction. This does look like an inconsistency in how wrangler d1 migrations apply validates the --temporary flag compared to deploy, d1 create, and kv namespace create, which appear to accept the cached temp-preview-account credential correctly. We'll take a look at the auth check for this command. If you find any additional details in the meantime (for example whether it reproduces without the prior d1 create --temporary step), feel free to add them here.

Structured summary (JSON)

{
  "issueNumber": 15171,
  "title": "wrangler d1 migrations apply --remote --temporary fails claiming user is already authenticated",
  "githubUrl": "https://github.com/cloudflare/workers-sdk/issues/15171",
  "recommendation": "KEEP OPEN",
  "difficulty": "medium",
  "reasoning": "Complete, reproducible bug report describing an inconsistency in how the d1 migrations apply command validates the --temporary flag against cached temp-preview-account credentials, unlike deploy/d1 create/kv namespace create.",
  "suggestedAction": "Route to a Wrangler maintainer to verify the --temporary auth guard in the d1 migrations apply code path and align it with other --temporary-supporting commands.",
  "hasSuggestedComment": true,
  "suggestedLabels": []
}

[workers-devprod]

• Reproduction: ✅ Successfully reproduced. Confirmed via vitest: d1 migrations apply --remote --temporary throws already-authenticated because requireAuth is called multiple times. After the first call activates the temp account, the second call sees getAPIToken() returning the temp token and wrongly treats it as real auth.