# Plan the overlap window when rotating a Cloudflare service-token secret

> Secret rotation can preserve the client ID while allowing a deliberate transition between secrets.

- Canonical URL: https://update.dsesecurity.com/updates/cloudflare-service-token-secret-rotation-grace-window/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T13:33:23+00:00
- Modified: 2026-10-15T13:36:16+00:00
- Last reviewed by DSE: 2026-10-15
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Secret rotation can preserve the client ID while allowing a deliberate transition between secrets.

## Potentially affected

This covers Access service-token secret rotation. Check the organization’s strict-authentication setting and current client integration before assuming behavior from an older service-token example.

## DSE recommendation

DSE recommends inventorying every client that uses a token before rotation.

## Article

Secret rotation can preserve the client ID while allowing a deliberate transition between secrets.

## Source facts

Cloudflare service tokens provide credentials for automated clients. The documented rotation operation keeps the Client ID and generates a replacement Client Secret. Administrators can choose a grace period during which the old and new secrets both work, or revoke the old secret immediately. Clients must be updated before that grace period ends. Service Auth policies are the appropriate policy action for accepting these credentials without a human IdP login. Strict service-token authentication also changes how cookies, Allow policies, and failed nonbrowser requests are handled.

Source: [Cloudflare — Service tokens](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/).

## Applicability

This covers Access service-token secret rotation. Check the organization’s strict-authentication setting and current client integration before assuming behavior from an older service-token example.

## DSE recommendation

DSE recommends inventorying every client that uses a token before rotation. Assign an owner to each scheduled job, appliance integration, and secret-store entry. Choose a transition window based on the slowest approved update path, and use immediate revocation when the incident response decision requires it. Distribute the replacement through protected secret storage, not ordinary tickets. Track completion by client rather than by the existence of a newly generated secret, and retain a rollback decision that does not accidentally reauthorize an exposed credential.

## Verification

Use a test token to verify the new secret during the overlap, update a controlled client, and confirm rejection of the old secret after its deadline. Check failure responses using the actual nonbrowser client. Record identifiers and results while excluding both secret values from logs.

## Official reference

[Cloudflare — Service tokens](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/). Reviewed October 15, 2026.

## Primary reference

- Name: Cloudflare — Service tokens
- Authority: developers.cloudflare.com
- URL: https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Plan the overlap window when rotating a Cloudflare service-token secret,” DSE Security, https://update.dsesecurity.com/updates/cloudflare-service-token-secret-rotation-grace-window/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.