Got Service Tokens you forgot about? Cloudflare Access now tidies them up automatically!
Hi everyone, it's Shiichan! I have a question for anyone running Cloudflare Access today: do you have any service tokens sitting around that nobody's using anymore?
Cloudflare Changelog
developers.cloudflare.com
What was announced?
Cloudflare's Changelog announced that Access administrators can now automatically disable or delete inactive service tokens. You can set an inactivity period anywhere from 30 to 365 days, and choose what happens once a token hits that limit: disabling it or deleting it.
The story so far
Until now, if a service token stopped being used, it just kept sitting there until someone manually noticed and cleaned it up. Old tokens that nobody uses but are still valid are exactly the kind of thing that quietly adds security risk over time.
What changes
Now Cloudflare can clean up inactive service tokens for you automatically. Admins just set a policy, and the system periodically checks and handles it, so you don't have to manually audit for stale tokens anymore. It's a quiet feature, but it really helps keep your security hygiene in good shape!
Dive Deep
To be eligible for cleanup, a token has to meet all of these conditions:
- It's older than the configured inactivity period
- It hasn't successfully authenticated during that period
- It isn't directly referenced by an Access policy rule
Cleanup runs gradually in the background, so eligible tokens might not be disabled or deleted immediately. That seems designed to avoid any surprise "it just vanished" moment.
Wrap-up
- Cloudflare Access can now automatically disable or delete inactive service tokens
- Admins choose an inactivity period from 30 to 365 days
- Only tokens that are old enough, unused, and not directly referenced by a policy are eligible
- Cleanup happens gradually in the background
If you're managing a lot of service tokens in Access, this quiet little feature will make your life easier!
