Tags Arrive for Access Service Tokens, So You Can Authorize by Environment!

Hi, it's Shii-chan! Cloudflare One's Access just got an update that makes service tokens much easier to manage.

Cloudflare Changelog developers.cloudflare.com

What was announced?

The Cloudflare Changelog announced that you can now assign key-value tags to Access service tokens. You can use the tags to organize credentials or control application access.

The story so far

To allow a service token, you had to name each token in a policy. Authorizing them by group, like production or by team, was a hassle.

What changes

With tags in place, a policy can say something like "allow tokens tagged environment: production". You don't have to list tokens one by one, so it stays manageable as tokens multiply!

Dive Deep

Here are the details of the tags.

• Each token supports up to five tags
• Examples: environment: production and team: payments
• Add or edit tags when you create or update a token in the dashboard or the service token API
• Search and filter by tag on the Service Tokens page
• Tags also appear in Resource Tagging, where you can query them alongside other tagged resources

On the policy side, the Service Token Tag selector matches valid tokens with an exact key-value pair, and you use it in a Service Auth policy. Here's an API policy example:

{
  "name": "Production service tokens",
  "decision": "non_identity",
  "include": [
    {
      "service_token_tag": {
        "key": "environment",
        "value": "production"
      }
    }
  ]
}

This accepts valid tokens tagged environment: production. For setup, see Tag service tokens and Authorize service tokens by tag in the docs.

Wrap-up

• Service tokens can carry up to five key-value tags
• Manage them in the dashboard or API, with search and filtering
• The Service Token Tag selector authorizes matching tokens in bulk

This one is for anyone with production and staging tokens all mixed together, or anyone tidying up Zero Trust policies!