JA EN
shiichan

Cloudflare Stream Broadcast Keys Can Now Be Rotated Instantly!

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#security#infrastructure

Hi, it's Shiichan! I found some news that makes live streaming security a lot stronger, so let me walk you through it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog announced that you can now rotate broadcast keys for Stream live inputs. The live input's identifier (ID) stays the same, but the credentials themselves get refreshed.

Why it matters

Broadcast keys are the credentials you plug into software like OBS, and they carry real risk of leaking: they can show up in a screenshare by accident, get hardcoded into client code, or end up shared with the wrong audience. Until now, the only fix was recreating the entire live input, which meant updating every URL and config that referenced it. That also made it hard to build in routine key rotation as part of a security process.

What changes

If a key leaks, you no longer have to rebuild your whole streaming setup — you can just swap the credentials while keeping everything else intact. Running a rotation immediately revokes the old key and disconnects any broadcast still using it, then returns the refreshed credentials in the API response. This also makes it much easier for teams who want scheduled key rotation as a standard security practice.

Dive Deep

Rotating keys is a single POST request to this endpoint:

POST https://api.cloudflare.com/client/v4/accounts/{account_id}/stream/live_inputs/{live_input_identifier}/rotate_keys

Authentication uses a Bearer token in the Authorization header:

curl --request POST \
https://api.cloudflare.com/client/v4/accounts/{account_id}/stream/live_inputs/{live_input_identifier}/rotate_keys \
--header "Authorization: Bearer {API_TOKEN}"

Live input responses also now include a new keysRotatedAt field showing when the keys were last rotated. This field is omitted for live inputs whose keys have never been rotated. For endpoint details, check the "Rotate keys for a live input" docs; for general usage, see "Manage live inputs".

Wrap-up

  • Stream live inputs can now rotate broadcast keys without changing the live input ID
  • Just POST to .../stream/live_inputs/{live_input_identifier}/rotate_keys
  • Old keys are revoked and disconnected instantly; new keys come back in the response
  • The response now includes keysRotatedAt, showing the last rotation time (omitted if never rotated)

If you run live streaming infrastructure and want a clean way to handle leaked keys or scheduled rotation, this update is exactly for you!

Related posts