An access key issued to a tool rather than a person, scoped in advance to specific actions and resources, and revocable on its own.
What is an API token?
An API token is a long key you generate so a piece of software can act on your behalf. It differs from a password in three ways: what it can do is limited up front, which resources it can touch is chosen, and it can be revoked on its own without disturbing any other access. A password means "everything"; a token means "only this, only here".
Where tokens belong is clear enough: a deploy pipeline publishing a release, a script purging cache, an integration pulling order data. None of that requires giving account permissions to whoever runs the script — and the same holds on the Cloudflare side.
Using them well: scope, storage, revocation
- One job, one token. Generate a separate token per automation; a shared token becomes un-revocable in practice, because nobody knows what revoking it will break.
- Narrowest scope. A token that purges cache should not be able to write DNS — and that is decided when you create it, not later.
- Never in the repo. Tokens don't belong in code or in git history; use environment variables or the provider's secret store.
- Expiry and rotation. Set an expiry where you can and rotate on a schedule; permanent keys get forgotten.
- First task at offboarding. When you part ways with an agency or a developer, revoking their membership is not enough — tokens created for them must be revoked the same day.
Tokens complement rather than replace human member roles: roles for people, tokens for tools. How the two fit together is covered in our Cloudflare access management article.
Frequently asked questions
What is the difference between an API token and a password?
A password unlocks an entire identity; a token unlocks only what you defined. A token's scope is narrowed at creation, its use is attributable to a specific job, and it can be revoked alone. That makes issuing a token to an automation both safer and far easier to undo than handing over a password.
What should I do if a token leaks?
Revoke it first — before generating a replacement, because revocation stops the risk immediately. Then check what resources it could reach and review changes in that area through the audit log. Finally create the new token with a narrower scope and review where it gets stored: most leaks come from keys committed into code or git history.
Related concepts
Cloudflare
The infrastructure provider that sits between your domain and your visitors, bundling DNS, CDN, caching, SSL and bot protection into a single dashboard.
Cloudflare Member Roles
The system for inviting people into a Cloudflare account with permissions limited to the job they do; roles are defined across three scopes — account, domain and resource.