Cloudflare deprecates Service Key authentication for the API

What changed

Cloudflare deprecated Service Key authentication for its API. Requests authenticated with the X-Auth-User-Service-Key header will stop working on September 30, 2026. Cloudflare directs customers to API Tokens, which support scoped permissions, expiration, and revocation.

Who is affected

Teams and tooling that still authenticate Cloudflare API calls with Service Keys, including custom scripts, older automation, and any library that sets X-Auth-User-Service-Key.

cloudflared builds from November 2022 or later already use API Tokens. Older cloudflared versions and tools such as origin-ca-issuer that still depend on Service Keys need updates.

What you need to do

Required before September 30, 2026:

1. Inventory callers that send X-Auth-User-Service-Key.
2. Create an API Token with the minimum permissions each integration needs.
3. Replace Service Key authentication with the API Token flow.
4. Upgrade cloudflared to a November 2022+ build if you are still on an older release.
5. If you use origin-ca-issuer, upgrade to a release that supports API Token authentication.

After the deadline, Service Key auth will no longer work.

Migration effort

Likely low for most integrations: credential swap and permission scoping, without changing core Cloudflare product APIs. Effort rises if many systems still share a single Service Key or if token scopes must be redesigned carefully.

Cost impact

Unknown. Cloudflare’s notice describes an authentication method change and does not establish whether spend changes for any account. Absence of pricing detail is not evidence of neutral impact.