Access - Access service token secrets use a scannable format
UpdateUnverifiedAdded Sep 24, 2026
Cloudflare Access service token Client Secrets created on or after August 26, 2026, use the format cfast_[40 alphanumeric characters][8-character checksum] . The prefix and checksum make these credentials easier for secret scanning tools to identify with fewer false positives. Existing service token secrets continue to work and do not require rotation.
Topics: Security
More Cloudflare developer platform releases
Every Cloudflare developer platform release| Date | Release | Type |
|---|---|---|
| Aug 26 | AI Search - New Workers AI text generation models in AI Searchunverified Update | Update |
| Aug 26 | Flagship - Create app-scoped API tokens for Flagshipunverified Update | Update |
| Aug 26 | Log Explorer - Delete Log Explorer datasetsunverified Update | Update |
| Aug 26 | Logpush Connectors, Logs - Azure Functions-based Microsoft Sentinel connector deprecationunverified Deprecation | Deprecation |
| Aug 26 | Radar - Radar Researcher adds richer sources and URL Scanner explanationsunverified Beta | Beta |
| Aug 26 | WAF - WAF Release - 2026-08-26 - Emergencyunverified Update | Update |
| Aug 26 | Workers AI - Z.ai GLM-5.3 Flash now available on Workers AIunverified Update | Update |
| Aug 27 | Automatic Platform Optimization - APO caches more crawler and bot traffic againunverified Update | Update |
Also shipped on Aug 26, 2026
Cloudflare in August 2026
Sources: each vendor's own release notes, changelogs and GitHub releases, read daily to monthly by how often it posts. Logos via logo.dev; trademarks belong to their owners.