JA EN
shiichan

Leaked Token? Auto-Revoked: Cloudflare Hardens Non-Human Identity Security!

Cloudflare Blog ★★★★ View Markdown
#cloudflare#security#devops

Hey there, it's me, Shii-chan! Today's a fun security update: in an age where AI agents call APIs on their own, the way we guard our "keys" just got a lot smarter.

Cloudflare Blog blog.cloudflare.com

What was announced?

The Cloudflare Blog announced three updates for safely handling non-human identities (identities that aren't people, like agents, scripts, and third-party tools):

  • Scannable API tokens that get revoked automatically if they leak
  • OAuth visibility plus a "Connected Applications" view so you can see who has access
  • Resource-scoped permissions, now generally available (GA)

What I love is that you can get hands-on with all of these in your own account today.

Cloudflare frames identity as three characters: the Principal (the Traveler), which is the identity itself; the Credential (the Passport), the API token that proves who you are; and the Policy (the Visa), the permissions that decide where you're allowed in. All three got stronger at once.

Why it matters

Once agents start carrying their own credentials, the risk of one of those keys accidentally leaking into a public GitHub repo goes way up. Managing these non-human principals is a big theme in the OWASP agentic AI threats work, and secret leakage remains a stubborn problem highlighted in the GitGuardian report, so it's not something to ignore.

What changes

First, the time from "a token leaks" to "we catch it and stop it" gets much shorter. New tokens are recognizable at a glance, and through an integration with GitHub Secret Scanning they can be revoked automatically the moment they're exposed.

On the OAuth side, you can now clearly see which third-party apps are connecting to which accounts and with what permissions, and revoke the ones you no longer need.

Permissions can also be narrowed to "just this specific resource" instead of "the whole account," making least privilege much easier to practice.

Dive Deep

New API tokens come with a purpose-specific prefix and a checksum at the end:

User API Key:      cfk_[40 chars][checksum]
User API Token:    cfut_[40 chars][checksum]
Account API Token: cfat_[40 chars][checksum]

That checksum lets Cloudflare verify a token is genuine before revoking it, so even when GitHub surfaces one, only the real ones get shut down.

Leak protection extends into Cloudflare One too: with the Credentials and Secrets DLP profile, you can detect and block tokens across your network (Gateway), email, cloud storage (CASB), and AI traffic (AI Gateway).

For OAuth, a new Connected Applications dashboard lets you review the apps you've authorized and revoke them with a click. The consent screen also shows each app's name, logo, and publisher, the scopes it requests, and the target accounts.

And resource-scoped permissions are now GA. You can scope grants to individual resources like Access Applications, Identity Providers, Policies, Service Tokens, and Targets. There are new roles too: at account scope, CDN Management, MCP Portals, Radar, Request Tracer, and SSL/TLS Management; at zone scope, Analytics, Logpush, Page Rules, Security Center, Snippets, and Zone Settings. The Roles and Scope docs go into the details.

Wrap-up

  • Three updates guard non-human identities across the Principal, Credential, and Policy layers
  • API tokens now carry a prefix plus checksum and auto-revoke on leak via GitHub Secret Scanning
  • Cloudflare One DLP detects tokens across network, email, storage, and AI traffic
  • OAuth gets visibility and revocation via Connected Applications, and resource-scoped permissions are GA
  • To start today, head to the API tokens dashboard and reissue old tokens in the new format

This one's for anyone letting AI agents touch APIs, teams running production on Cloudflare, and security folks who want least privilege done right!

Related posts