EOL date
Cloudflare says Service Keys stop working on 30 September 2026.
Buyer-intent answers
Cloudflare · API auth · Service Key EOL
Cloudflare Service Key EOL: Move API Callers to Scoped Tokens Before 30 September 2026
A Cloudflare-backed migration checklist for API integrations that still send X-Auth-User-Service-Key and need to move to scoped API Tokens before Service Key authentication stops working.
Primary query: Cloudflare Service Key API Token migration September 30 2026 X-Auth-User-Service-Key · Updated 2026-09-07
Direct answer
What should a Cloudflare API customer do before Service Key authentication stops working on 30 September 2026?
Cloudflare says Service Key authentication is deprecated and X-Auth-User-Service-Key will stop working on 30 September 2026. The replacement is a scoped API Token. A safe migration starts by finding every caller that still uses the legacy header, identifying the minimum permissions required by each caller, creating replacement tokens inside Cloudflare, updating the caller without exposing the token to external tooling, and replaying read-only or synthetic acceptance requests before the legacy credential path disappears.
Practical sequence
What to do next
- 01
Search application, automation, IaC and deployment configuration for X-Auth-User-Service-Key and inventory every affected Cloudflare API caller.
- 02
For each caller, list the actual endpoints and actions it needs so the replacement API Token can be scoped to the minimum necessary permissions.
- 03
Create and store the replacement token using the organisation’s approved secret-management process; do not paste raw production tokens into a public migration checker.
- 04
Update one caller at a time and run safe read-only or synthetic acceptance requests that prove authentication and required permissions work as intended.
- 05
Complete the remaining cutovers and keep an owner/evidence register before 30 September 2026, then remove obsolete Service Key dependencies according to the organisation’s security process.
Decision facts
Legacy header
The deprecated authentication path uses X-Auth-User-Service-Key.
Replacement
Cloudflare directs customers to API Tokens with finer-grained permissions, expiration and revocation controls.
Boundaries
- — This workflow should never collect, display or transmit production Cloudflare tokens or Service Keys outside the customer’s approved secret-management environment.
- — The least-privilege permission set depends on the endpoints each integration actually uses; confirm scopes against current Cloudflare API documentation.
Free proof before paid workflow