No more waiting on Super Admins: members can self-serve Account API tokens

Hi everyone, it's Shii-chan! Today's update means less time waiting on an admin to issue tokens!

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog announced that Account API token creation is no longer limited to Super Administrators.

The story so far

Only Super Administrators could create Account API tokens. Developers and platform teams had to depend on a Super Administrator even to provision a single credential.

What changes

Members with the API Token Provisioning role can now create Account API tokens through the dashboard, API, Terraform, or CF CLI.

Dive Deep

Here's what changed:

• Delegated creation: members with the API Token Provisioning role can create tokens from the dashboard. Administrators can grant the role through the dashboard, API, or Terraform
• OAuth support: OAuth clients that request the account_api_tokens:create scope, starting with Cloudflare CLI, can create Account API tokens
• Permissions limited to the creator: members can only create a token with permissions they already have. For OAuth-created tokens, permissions are also limited to the scopes granted during authorization
• Creator attribution and visibility: tokens now include creator metadata. Super Administrators and Administrators can view all Account API tokens in an account, while members with the role see only tokens they created

Wrap-up

• Account API token creation is open to members with the API Token Provisioning role
• Create from the dashboard, API, Terraform, or CF CLI
• Permissions stay within the creator's own, so they can't be widened
• Creator metadata lets you trace who made each token

This suits platform teams who want self-serve developers while keeping least privilege!