Can`t generate a Cloudflare SSH CA

[daap213]

Existing documentation URL(s)

https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#6-configure-ssh-server

What changes are you suggesting?

I followed the steps in the document, creating the respective token, with the necessary permissions, I tested it and the response is that it is active:
{"result":{"id":"qqqqqqqqqqqq","status":"active"},"success":true,"errors":[],"messages":[{"code":10000,"message":"This API Token is valid and active","type":null}]}
But when I want to run:
curl --request POST
"https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/access/gateway_ca"
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

it returns:
{"success":false,"errors":[{"code":10000,"message":"Authentication error"}]}

Additional information

No response

[ranbel]

Hey @daap213 thanks for raising this issue. I was unable to replicate the auth error. Here is the token I used:

Have you checked if your token is assigned to the correct account?

[daap213]

Hey @ranbel At https://dash.cloudflare.com/******/api-tokens I created the token shown in the image, selecting only my account.

In summary I have this:
This API token will affect the below accounts and zones, along with their respective permissions

MyEmail's Account - Access: SSH Auditing:Edit
Client IP Address Filtering

Is in - to ip/24

[ranbel]

Could it be an issue with your Client IP Address Filtering config? I would try removing the IP filter and see if it works. If so, check if the public IP of your machine matches the IP filter.

[daap213]

It is mandatory to assign an IP, otherwise it gives the error:
Enter valid IP addresses,

Also, from that IP if I make the request to verify the token, it gives me a response that it is active

[ranbel]

According to the documentation, the verify token endpoint doesn't check the request IP. So it makes sense that verification worked.

You should be able to create a new token and leave the Client IP Address Filtering field blank:

[daap213]

Yes, I had to create a new one, and it works

[ranbel]

Glad it worked! I'm going to close this issue since the SSH docs have the correct information. I'll open an internal ticket to improve documentation around the "code":10000 API error.