Plan the overlap window when rotating a Cloudflare service-token secret

Secret rotation can preserve the client ID while allowing a deliberate transition between secrets.

Source facts

Cloudflare service tokens provide credentials for automated clients. The documented rotation operation keeps the Client ID and generates a replacement Client Secret. Administrators can choose a grace period during which the old and new secrets both work, or revoke the old secret immediately. Clients must be updated before that grace period ends. Service Auth policies are the appropriate policy action for accepting these credentials without a human IdP login. Strict service-token authentication also changes how cookies, Allow policies, and failed nonbrowser requests are handled.

Source: Cloudflare — Service tokens.

Applicability

This covers Access service-token secret rotation. Check the organization’s strict-authentication setting and current client integration before assuming behavior from an older service-token example.

DSE recommendation

DSE recommends inventorying every client that uses a token before rotation. Assign an owner to each scheduled job, appliance integration, and secret-store entry. Choose a transition window based on the slowest approved update path, and use immediate revocation when the incident response decision requires it. Distribute the replacement through protected secret storage, not ordinary tickets. Track completion by client rather than by the existence of a newly generated secret, and retain a rollback decision that does not accidentally reauthorize an exposed credential.

Verification

Use a test token to verify the new secret during the overlap, update a controlled client, and confirm rejection of the old secret after its deadline. Check failure responses using the actual nonbrowser client. Record identifiers and results while excluding both secret values from logs.

Official reference

Cloudflare — Service tokens. Reviewed October 15, 2026.