How to rotate your Cloudflare API token

Updated October 2026

Create a new, scoped Cloudflare API token under your profile or account settings, swap it into your app, then revoke the old one. Cloudflare shows you the token's value exactly once.

Here's the manual process, from Cloudflare's own docs.

The manual steps

1. In the Cloudflare dashboard, go to My Profile > API Tokens for a personal token, or Manage Account > API Tokens for an account token.
2. Click Create Token.
3. Choose a template, or build a custom one.
4. Name the token so you'll recognize what it's for later.
5. Set permissions. Edit gives full create, read, update, delete and list access. Read is read-only.
6. Choose which specific resources the token can reach.
7. Optionally add IP filtering and a time-to-live limit.
8. Review the summary, then click Create Token.
9. Copy the secret right away. Cloudflare's docs say plainly that "the token secret is only shown once."

Cloudflare's own docs cover every step above, checked October 24, 2026.

What breaks if you miss a place

Cloudflare's own docs don't spell out the exact timing of what happens the moment you revoke an old token, only that you can edit a token after creating it. Treat that as unconfirmed rather than assume it's instant. Any script, CI job, or integration still holding the old token keeps using it until you actually revoke it, and since there's no documented grace period, don't count on one.

How to check the old token is actually dead

Since Cloudflare's own pages don't document exact revoke timing, test it directly. Make one API call with the old token after revoking it. A request that now fails with a permissions or authentication error confirms the token is dead. If it still succeeds, give it a moment and test again rather than assuming it's gone.

Setting a time-to-live from the start

The one thing that avoids this problem entirely is setting a TTL when you first create the token, so it expires on a schedule whether or not anyone remembers to revoke it by hand.

Or let Key Robot do it

This one's coming next, built and being tested. Once it's live, Key Robot will create the new token, confirm your app still works with it, and only then revoke the old one, from your own GitHub Actions, with the token locked in your browser and never stored on Key Robot's own server.

That testing is not a formality. Our own test kit runs 8 checks on every service we support, and it already caught a bug in our own code where Kill it now kept a leaked secret working as a backup value. We fixed it before launch.

Why scoping matters here

A Cloudflare token can be as broad or as narrow as you make it at creation. A token scoped to one zone and one permission group does far less damage if it leaks than an account-wide Edit token would. Build the narrowest token the job actually needs, every time you create one, not just when you remember to.

The same rule applies when you're deciding how many tokens to keep around. One broad token used everywhere is convenient until it leaks once, and then every single integration it touches has to be rotated at the same time. A handful of narrow, single-purpose tokens means a leak only costs you one swap, not a dozen.

See how to rotate your Supabase key and how to rotate your OpenAI key for the other two services on the same timeline, or the rotate hub for what's already live.