# Flagship API Tokens Can Now Be Scoped to a Single App!

Hi, it's me! Today Cloudflare shipped a small but genuinely useful security upgrade, and if you're using Flagship, this one's for you!

## What was announced?

Cloudflare's Changelog announced that you can now create app-scoped API tokens for Flagship. Until now, custom tokens could only grant access to every Flagship app in your account. Now you can create a token that's limited to just the specific apps you choose!

Flagship is Cloudflare's edge-based feature flag service, letting you toggle features on and off without redeploying your code. This update is about tightening up access control on a per-app basis.

## The story so far

Previously, when creating a custom token, the resource dropdown defaulted to `Entire Account`, and that was the only option available — every token could reach every Flagship app in the account. Even if you only needed a token for a single app, you ended up handing out access to all of them.

## What changes

Now you can open the resource dropdown and select `Specified Flagship apps` instead, then pick the app and a permission level for it. This means a token you hand to a CI pipeline or a backend service can be limited to touch only that one app — so if the token ever leaks, the blast radius stays small. It's a straightforward way to put the principle of least privilege into practice!

## Dive Deep

App-scoped tokens support three permission levels per app:

- `Evaluate` — can only evaluate flags
- `Read` — can read flag configuration
- `Write` — can create and modify flags

Account-wide Evaluate / Read / Write permissions are still available too, for cases where you genuinely need access to every app.

The intended use case is trusted server-side environments, specifically:

- Operating Flagship from Wrangler
- Managing flags inside a CI build or deploy pipeline
- Embedding a token in a backend service that should only touch one app

To create one, just go to the API token creation screen in the dashboard, switch the resource type to `Specified Flagship apps`, and choose the app and permission. Full steps are in the API tokens documentation.

## Wrap-up

- Flagship now supports API tokens scoped to a single app
- Permissions come in three levels: `Evaluate`, `Read`, and `Write`
- Account-wide permissions are still available when you need them
- Great fit for server-side automation via Wrangler, CI, or single-app backend services

This one's aimed squarely at engineers running Flagship from CI or backend automation!