Repository navigation
Conversation
| To recover a disabled token after a leak report: | ||
|
|
||
| <Steps> | ||
| 1. [Rotate the token's secret](#rotate-service-token-secrets). In the dashboard, select _Revoke immediately_. In an API rotation request, omit `previous_client_secret_expires_at`. |
There was a problem hiding this comment.
I would update this to: "In the dashboard, select Rotate secret — the current secret is revoked immediately."
There is no 'revoke immediately' option. It looks like:
| When editing an Access application, selecting **Revoke existing tokens** revokes existing sessions but does not prevent the user from starting a new session. As long as the Client ID and Client Secret are still valid, they can be exchanged for a new token on the next request. To revoke access, you must delete the service token. | ||
| ::: | ||
|
|
||
| ## Set a token expiration alert |
There was a problem hiding this comment.
If you want to group these changes I would also update this section to include leaked service token notifications
🚀 Deploying Preview to Cloudflare 🚀Preview URL: https://kjohnson-leaked-service-token-recovery.previews.developers.cloudflare.com (commit b5c789b)This URL reflects your latest Preview deploymentPreview Deployments by commit
|
| - access | ||
| - cloudflare-one | ||
| --- | ||
|
|
There was a problem hiding this comment.
Do we want to mention the automatic disablement portion (how the service token gets reported as leaked). Something like: "When a leak is reported by a secret scanning partner such as GitHub, Cloudflare automatically disables the token and notifies account administrators by email"
Not sure if you were just waiting on the GitHub partnership being finalized for this
Typically, changelog entries should be dated the day they merge. This is not blocking — if the date is unintentional, please update it. |
3 participants
Summary
Documents recovery for Access service tokens reported as leaked: rotate without a grace period, update services, then re-enable the token. Includes leak metadata, API error behavior, and a changelog entry.
This change covers recovery, not a new notification subscription workflow.
Documentation checklist