Flagship API Tokens Can Now Be Scoped to a Single App!

Hi, it's me! Today Cloudflare shipped a small but genuinely useful security upgrade, and if you're using Flagship, this one's for you!

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog announced that you can now create app-scoped API tokens for Flagship. Until now, custom tokens could only grant access to every Flagship app in your account. Now you can create a token that's limited to just the specific apps you choose!

Flagship is Cloudflare's edge-based feature flag service, letting you toggle features on and off without redeploying your code. This update is about tightening up access control on a per-app basis.

The story so far

Previously, when creating a custom token, the resource dropdown defaulted to Entire Account, and that was the only option available — every token could reach every Flagship app in the account. Even if you only needed a token for a single app, you ended up handing out access to all of them.

What changes

Now you can open the resource dropdown and select Specified Flagship apps instead, then pick the app and a permission level for it. This means a token you hand to a CI pipeline or a backend service can be limited to touch only that one app — so if the token ever leaks, the blast radius stays small. It's a straightforward way to put the principle of least privilege into practice!

Dive Deep

App-scoped tokens support three permission levels per app:

• Evaluate — can only evaluate flags
• Read — can read flag configuration
• Write — can create and modify flags

Account-wide Evaluate / Read / Write permissions are still available too, for cases where you genuinely need access to every app.

The intended use case is trusted server-side environments, specifically:

• Operating Flagship from Wrangler
• Managing flags inside a CI build or deploy pipeline
• Embedding a token in a backend service that should only touch one app

To create one, just go to the API token creation screen in the dashboard, switch the resource type to Specified Flagship apps, and choose the app and permission. Full steps are in the API tokens documentation.

Wrap-up

• Flagship now supports API tokens scoped to a single app
• Permissions come in three levels: Evaluate, Read, and Write
• Account-wide permissions are still available when you need them
• Great fit for server-side automation via Wrangler, CI, or single-app backend services

This one's aimed squarely at engineers running Flagship from CI or backend automation!