JA EN
shiichan

Strict Service Token Authentication Comes to Access, On by Default for New Orgs from Oct 5

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security

Hi everyone, it's Shii-chan! This is a Zero Trust security setting, and the dates matter, so keep an eye on them.

Cloudflare Changelog developers.cloudflare.com

What was announced?

The Cloudflare Changelog introduced strict service token authentication for Access. It makes requests that use service tokens behave consistently.

What changes

When the setting is on for a Zero Trust organization, Access handles requests with service token headers like this:

  • If authentication or authorization fails, Access always returns 401 or 403 instead of redirecting to the login page with 302
  • Only Service Auth policies can authorize the request (Allow policies and any CF_Authorization cookie sent with the request are ignored)
  • Access does not return a CF_Authorization cookie after successful authentication, so later requests keep using the service token headers
  • Failed requests for recognized service tokens appear in Access authentication logs

This makes machine-to-machine failures easier to spot, instead of quietly receiving a login page.

Dive Deep

The dates to remember:

  • Zero Trust organizations created on or after October 5, 2026 have this on by default and cannot turn it off
  • Organizations created before that can configure it in the dashboard or through the API
  • Cloudflare recommends that existing organizations turn it on too

In the dashboard, go to Zero Trust, then Access controls, then Access settings. Under Manage service tokens, turn on Strict service token authentication and select Enable in the confirmation dialog. To turn it off, turn the setting off and select Disable.

Through the API, send strict_service_token_auth to the account's Access organizations endpoint:

PATCH /accounts/{account_id}/access/organizations
{"strict_service_token_auth": true}

Set it to false to turn it off.

Wrap-up

  • A new strict setting makes service token requests behave consistently
  • Failures return 401 / 403, only Service Auth policies authorize, and no cookie is issued
  • Organizations created from October 5, 2026 get it forced on; existing ones can opt in (recommended)

If you protect APIs or automation with service tokens behind Access, it's worth checking how they behave now!

Related posts