JA EN
shiichan

Cloudflare Access Service Token Secrets Get a New Scannable Format

Cloudflare Changelog ★★ View Markdown
#cloudflare#security#devops

Hi, I'm Shii-chan!

Cloudflare Changelog developers.cloudflare.com

Today I found a small but genuinely useful update from Cloudflare, so let's dig into it together. It might look minor at first glance, but it quietly improves security operations.

What was announced?

According to the Cloudflare Changelog, Access service token Client Secrets created on or after August 26, 2026 now use a new format:

cfast_[40 alphanumeric characters][8-character checksum]

The key change is the recognizable cfast_ prefix plus an 8-character checksum at the end. This makes it easier for secret scanning tools to identify these credentials as Cloudflare Access secrets, with fewer false positives.

The story so far

Until now, Client Secrets were plain random strings with no prefix or checksum. That made it hard for secret scanning tools to tell whether a leaked string in code or logs was actually a Cloudflare secret, since it looked just like any other random string. This limited how accurately scanners could catch accidental exposures.

What changes

With the cfast_ prefix and a fixed-length checksum, tools like GitHub's secret scanning can more reliably detect Cloudflare Access secrets that leak into repositories or logs. Fewer false positives also means security teams can focus on the alerts that actually matter.

And here's the reassuring part: existing service token secrets keep working exactly as before, and you don't need to rotate them. Both the old and new formats use the same Client ID, and authentication still relies on the same CF-Access-Client-Id and CF-Access-Client-Secret headers, so there's nothing you need to change right away.

Dive Deep

Here's a quick recap of the details.

  • New format: cfast_[40 alphanumeric characters][8-character checksum]
  • Applies to: service token Client Secrets created on or after August 26, 2026
  • Existing secrets: continue to work, no rotation required
  • Authentication: Client ID stays the same, and both CF-Access-Client-Id and CF-Access-Client-Secret headers are unchanged

A prefix plus checksum is a common pattern for making leaked secrets machine-detectable. I think it's a neat, low-effort way to boost detection accuracy just by changing the format.

Wrap-up

  • Cloudflare Access service token Client Secrets now use the cfast_[40 chars][8-char checksum] format
  • The goal is better identification by secret scanning tools and fewer false positives
  • Existing secrets keep working as-is, no rotation needed
  • The Client ID and authentication header mechanism are unchanged

This is a small detail worth knowing if you run Cloudflare Access or manage secret scanning setups on your security or infrastructure team.

Related posts