diff --git a/src/content/changelog/access/2026-10-14-leaked-service-token-recovery.mdx b/src/content/changelog/access/2026-10-14-leaked-service-token-recovery.mdx
new file mode 100644
index 00000000000..3ccf8436711
--- /dev/null
+++ b/src/content/changelog/access/2026-10-14-leaked-service-token-recovery.mdx
@@ -0,0 +1,16 @@
+---
+title: Rotate leaked Access service tokens before re-enabling them
+description: Access requires secret rotation before a service token reported as leaked can be re-enabled.
+date: 2026-10-14
+products:
+ - access
+ - cloudflare-one
+---
+
+A Cloudflare Access service token reported as leaked cannot be re-enabled until its secret is rotated. This prevents a disabled credential from being put back into use without replacing the exposed secret.
+
+Leaked secrets do not support a rotation grace period. When you rotate one, the previous secret is discarded immediately. Update your services with the new secret, then re-enable the token.
+
+For API rotations, omit `previous_client_secret_expires_at`. A future expiration returns `400`; attempting to re-enable the token before rotation returns `409`.
+
+For recovery steps and leak metadata fields, refer to [Recover a leaked service token](/cloudflare-one/access-controls/service-credentials/service-tokens/#recover-a-leaked-service-token).
diff --git a/src/content/docs/cloudflare-one/access-controls/service-credentials/service-tokens.mdx b/src/content/docs/cloudflare-one/access-controls/service-credentials/service-tokens.mdx
index 69748eeb742..18d450744ec 100644
--- a/src/content/docs/cloudflare-one/access-controls/service-credentials/service-tokens.mdx
+++ b/src/content/docs/cloudflare-one/access-controls/service-credentials/service-tokens.mdx
@@ -136,6 +136,8 @@ Rotate a service token secret when you suspect exposure or as part of regular cr
You can set a grace period during which both secrets work. Use this period to update your services before Access revokes the previous secret.
+For a token [reported as leaked](#recover-a-leaked-service-token), the previous secret must expire immediately. You cannot use a rotation grace period.
+
@@ -165,6 +167,32 @@ To revoke the previous secret immediately, omit `previous_client_secret_expires_
+## Recover a leaked service token
+
+Cloudflare can receive service token leak reports from secret scanning partners, such as GitHub. A token reported as leaked cannot be re-enabled until you rotate its secret.
+
+To recover a disabled token after a leak report:
+
+
+1. [Rotate the token's secret](#rotate-service-token-secrets). In the dashboard, select _Revoke immediately_. In an API rotation request, omit `previous_client_secret_expires_at`.
+2. Replace the leaked secret in your services with the new Client Secret. The Client ID stays the same.
+3. [Turn the token on again](#turn-a-service-token-on-or-off). Rotation does not automatically re-enable a disabled token.
+
+
+Remove the exposed secret from the location identified in the report. Removing it does not replace rotation: the secret may already have been copied.
+
+The service token API returns these read-only fields when available:
+
+| Field | Description |
+| ------------------ | -------------------------------------------------------- |
+| `leak_reported_at` | When a secret scanning partner reported the leak. |
+| `leak_reporter` | The secret scanning partner that reported the leak. |
+| `leak_report_url` | Where the secret was found, if provided by the reporter. |
+
+Rotation clears the token's leak metadata. Review [admin activity logs](/cloudflare-one/insights/logs/dashboard-logs/admin-activity-logs/) for the audit history.
+
+Attempting to re-enable a token before rotation returns `409`. Requesting a future `previous_client_secret_expires_at` when rotating a leaked token returns `400`. The leaked secret is discarded immediately and cannot be restored by extending its expiration.
+
## Renew service tokens
Service tokens expire according to the token duration you selected when you created the token.