Feature: CLI command to create API tokens (wrangler tokens create)

[shkumbinhasani]

Description

Currently, there's no way to create Cloudflare API tokens from the CLI. When setting up CI/CD pipelines (e.g., GitHub Actions), users must manually navigate to the dashboard at https://dash.cloudflare.com/profile/api-tokens to create tokens with the right permission scopes.

This is a friction point, especially when you know exactly which permissions you need (Workers Scripts, D1, KV, etc.) and just want to generate a token quickly.

Proposed Solution

Add a wrangler tokens create command that:

1. Opens the browser to a pre-filled "Create Custom Token" page (similar to how wrangler login opens the OAuth consent screen)
2. Accepts permission flags so the token page is pre-configured:

# Example: create a token scoped for Workers + D1 deployment
wrangler tokens create \
  --name "my-ci-token" \
  --permissions "Workers Scripts:Edit" "D1:Edit" "Account Settings:Read"

3. After the user confirms in the browser, the token value is returned to the CLI via a localhost callback (same pattern as wrangler login)

Alternative / Simpler Approach

Even just a redirect to the dashboard with query parameters pre-filling the token creation form would be a huge improvement:

wrangler tokens create --name "ci-deploy"
# Opens: https://dash.cloudflare.com/profile/api-tokens/create?name=ci-deploy&...
# User confirms in browser, copies token back

Use Case

Setting up CI/CD for Cloudflare Workers deployments (GitHub Actions, GitLab CI, etc.) requires an API token. Today this means:

1. Open dashboard
2. Navigate to API tokens
3. Click create
4. Manually select permissions
5. Copy the token
6. Paste into CI secrets

With this feature, it becomes:

1. Run wrangler tokens create with the right flags
2. Confirm in browser
3. Token is printed / copied to clipboard

Context

• wrangler login already implements the browser OAuth redirect pattern, so the infra for browser-based CLI flows exists
• The Cloudflare API has a POST /user/tokens endpoint, but it requires existing token management permissions that OAuth tokens from wrangler login don't have — making it inaccessible programmatically for most users