JA EN
shiichan

DLP Can Now Spot Your Cloudflare API Tokens!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security

Hey there, it's me, Shiichan! Today I found a small update that helps keep your "must-not-leak" secrets safe, so let me tell you about it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

This one comes from the Cloudflare Changelog. Cloudflare added new entries to Data Loss Prevention (DLP) that detect Cloudflare's own API tokens.

The targets are three credential types in the new Cloudflare API token format, all detected within the "Credentials and Secrets" profile.

The story so far

DLP is the feature that finds sensitive data in your traffic — things like credit card numbers, source code, and various secrets — and lets you log or block it.

But until now, there wasn't a dedicated entry for detecting Cloudflare API tokens themselves. If a token accidentally slipped into a chat message or an upload, it could leave without anyone noticing.

What changes

From now on, if a Cloudflare API token shows up in your traffic, DLP can pick it up. You can log it, or block it with a Gateway policy, so you can stop an accidental leak just before it happens. It's a quietly useful win for teams running Cloudflare.

Dive Deep

The additions go into the "Credentials and Secrets" predefined DLP profile as these three entries:

  • Cloudflare User API Key (prefix cfk_)
  • Cloudflare User API Token (prefix cfut_)
  • Cloudflare Account Owned API Token (prefix cfat_)

These detections rely on the new credential format's structured prefix and a CRC32 checksum suffix. Thanks to that marker, they can find tokens with high confidence and a low false positive rate, even without surrounding context like an authorization header.

One thing to keep in mind: credentials created before the format change will not be detected by these entries.

Here's how you set it up:

  • In the Cloudflare dashboard, open Zero Trust > DLP > DLP Profiles
  • Select the "Credentials and Secrets" profile
  • Enable the Cloudflare API token entries you want
  • Apply the profile in a Gateway HTTP policy to log or block traffic

Wrap-up

  • Cloudflare's DLP now has entries that detect Cloudflare API tokens
  • They cover three types of the new format (cfk_ / cfut_ / cfat_)
  • Detection uses the prefix and CRC32 checksum, so it works even without context
  • Tokens in the old format are not covered, so keep that in mind

This is a handy update for security folks running Cloudflare who worry about token leaks.

Related posts