What I learned. When you search “pages” in Cloudflare’s token permission picker, you get “Custom Pages” — and it is not the hosting product. It’s a zone setting for custom error pages. The hosting product, “Cloudflare Pages”, only appears under account-scope permissions. Picking the wrong one cost me three failed deploys with a generic authentication error.
The second trap: Pages permission alone isn’t enough. Wrangler (v4) refuses to resolve your account without two extra read-only permissions — to its credit, the error names one:
🎢 Unable to get membership roles. Make sure you have permissions to
read the account. Are you missing the `User->Memberships->Read` permission?The token that finally worked carries three permissions: Account → Cloudflare Pages → Edit, User → Memberships → Read, Account → Account Settings → Read. The trio appears together in no tutorial I found — assembled here so your search lands somewhere.