Cloudflare Access Service Token Rotation No Longer Breaks Auth!
Hi, it's me, Shiichan! Today's pick from the Cloudflare Changelog is a small but genuinely nice improvement.
Cloudflare Changelog
developers.cloudflare.com
What was announced?
The Cloudflare Changelog announced a new option for rotating Access service token secrets: administrators can now choose a grace period when they rotate a secret.
The story so far
Rotating a service token secret used to carry a real risk: if every service using that token wasn't updated in sync with the rotation, authentication could break. This feature is meant to fix that by keeping both secrets valid for a while, giving administrators time to update their services.
What changes
During the grace period, both the old and new secret authenticate successfully. Here's what you can configure:
- Choose a grace period from 1 hour to 30 days in the dashboard
- Revoke the previous secret immediately instead, if you'd rather cut over right away
- Use the API to set a custom RFC 3339 expiration time for your own rotation schedule
That means you can rotate secrets calmly, without worrying about breaking authentication mid-rollout.
Wrap-up
- Cloudflare Access service tokens now support a grace period that keeps the old and new secret valid together during rotation.
- Set it from 1 hour to 30 days in the dashboard, or specify a custom RFC 3339 expiration through the API.
- You can still revoke the previous secret immediately if you want an instant cutover.
- A welcome update for anyone running Cloudflare Access with service token authentication.
