Summary

refreshToken in packages/wrangler/src/user/user.ts uses the refresh token cached in module-level localState, which is populated once at process startup and never re-read. OAuth refresh tokens are single-use: when a sibling wrangler process (another repo, another shell, or a parallel script) refreshes first, it rotates the token server-side and writes the new value to the shared global config file (~/Library/Preferences/.wrangler/config/default.toml on macOS, equivalents elsewhere). The long-lived process — typically wrangler dev — then sends its stale in-memory token on the next refresh and gets 401 Unauthorized from https://dash.cloudflare.com/oauth2/token, falling through to a fresh interactive OAuth login.

This matches every Failed to fetch auth token: 401 Unauthorized report I can find — and reproduces deterministically in a unit test.

Evidence from a real failure

Two wrangler processes on the same machine, started 60 minutes apart in different repos, both sent the same refresh_token=07RHxMHc…:

01:13:36 UTC  wrangler dev (repo A)         reads default.toml → RT_A
                                            holds RT_A in module-level localState
02:13:28 UTC  wrangler deploy (repo B)      reads default.toml → also RT_A
                                            refreshes successfully, CF rotates → RT_B
                                            writes RT_B to default.toml
02:53:41 UTC  wrangler dev (repo A)         access token expired, refresh fires
                                            sends stale RT_A from localState
                                            ← 401 Unauthorized
                                            → empty catch{} swallows the error
                                            → falls through to OAuth login prompt

Fix

Two changes inside refreshToken() (packages/wrangler/src/user/user.ts):

1. Call reinitialiseAuthTokens() before exchanging. Re-reads default.toml so the refresh request uses whatever value is currently on disk, not whatever was on disk when this process started. Cheap, idiomatic, eliminates the race for the realistic case where the sibling write lands seconds-to-hours before this refresh.
2. Replace the empty catch {} with a logger.debug call. The current swallowed error is exactly why this bug was hard to diagnose — WRANGLER_LOG=debug will now surface the failure mode.

A proper flock-style fix on default.toml is nicer but materially harder; this gets 99%+ of cases.

Test plan

• Added unit test in packages/wrangler/src/__tests__/user.test.ts (should re-read refresh_token from disk before refreshing in case a sibling process rotated it) — fails on main, passes with this change
• Full pnpm test -F wrangler src/__tests__/user.test.ts — 51/51 pass
• pnpm test -F wrangler src/__tests__/deploy/core.test.ts (other refresh-touching tests) — 48/48 pass
• pnpm check:type -F wrangler clean
• oxlint --deny-warnings --type-aware clean
• oxfmt --check clean

🤖 Generated with Claude Code

• Tests
  • Tests included/updated
  • Automated tests not possible - manual testing has been completed as follows:
  • Additional testing not necessary because:
• Public documentation
  • Cloudflare docs PR(s):
  • Documentation not necessary because: bug fix