Where Does cloudflared Store Config and Credentials?
cloudflared keeps config.yml, cert.pem, and per-tunnel credential files in .cloudflared: %USERPROFILE% on Windows, ~/.cloudflared elsewhere.
Last updated
cloudflared concentrates tunnel identity in one dot folder, and each file has a distinct job. The config.yml maps hostnames to origins. The cert.pem authorizes account-level management. Each tunnel's JSON file authenticates that tunnel alone.
That division decides what to copy and what to guard. Move config plus JSON to relocate a tunnel; guard the JSON like a password anywhere it rests. Service installs on Windows use the system profile's copy instead of yours, which explains tunnels that work by hand but fail as services.
Where cloudflared stores this, by platform
%USERPROFILE%\.cloudflared
config.yml for ingress rules, cert.pem for management auth, one JSON per tunnel. Services run from the system profile's copy, so check there when service tunnels misbehave.
~/.cloudflared
Same dot-folder layout on macOS. Homebrew services and launchd jobs may set --config explicitly, which overrides this default location.
~/.cloudflared
Same arrangement on Linux, with /etc/cloudflared and /usr/local/etc/cloudflared as further fallbacks. Systemd units commonly pin --config to one of those instead.
Frequently asked questions
How do I move a tunnel to another machine?
Copy the tunnel JSON credential file plus config.yml to the same relative spot. The UUID inside both must match, and the dashboard must still route the hostname to that tunnel id.
cert.pem is missing or expired. What recreates it?
Run cloudflared tunnel login to mint a fresh cert.pem. The cert authorizes tunnel management (create, delete, DNS); running an existing tunnel needs only its JSON credentials.
Notice an outdated path? Let us know.