Skip to content

[Access] Document leaked service token recovery #34341

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
kennyj42 wants to merge 2 commits into
base: production
Choose a base branch
from
Draft

[Access] Document leaked service token recovery #34341

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8210dc8
[Access] Document leaked service token recovery
kennyj42 Oct 14, 2026
b5c789b
Empty commit to trigger worker preview
mvvmm Oct 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions src/content/changelog/access/2026-10-14-leaked-service-token-recovery.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
---
title: Rotate leaked Access service tokens before re-enabling them
description: Access requires secret rotation before a service token reported as leaked can be re-enabled.
date: 2026-10-14
products:
- access
- cloudflare-one
---

@jayjesskay jayjesskay Oct 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we want to mention the automatic disablement portion (how the service token gets reported as leaked). Something like: "When a leak is reported by a secret scanning partner such as GitHub, Cloudflare automatically disables the token and notifies account administrators by email"

Not sure if you were just waiting on the GitHub partnership being finalized for this

A Cloudflare Access service token reported as leaked cannot be re-enabled until its secret is rotated. This prevents a disabled credential from being put back into use without replacing the exposed secret.

Leaked secrets do not support a rotation grace period. When you rotate one, the previous secret is discarded immediately. Update your services with the new secret, then re-enable the token.

For API rotations, omit `previous_client_secret_expires_at`. A future expiration returns `400`; attempting to re-enable the token before rotation returns `409`.

For recovery steps and leak metadata fields, refer to [Recover a leaked service token](/cloudflare-one/access-controls/service-credentials/service-tokens/#recover-a-leaked-service-token).
28 changes: 28 additions & 0 deletions ...tent/docs/cloudflare-one/access-controls/service-credentials/service-tokens.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,6 +136,8 @@ Rotate a service token secret when you suspect exposure or as part of regular cr

You can set a grace period during which both secrets work. Use this period to update your services before Access revokes the previous secret.

For a token [reported as leaked](#recover-a-leaked-service-token), the previous secret must expire immediately. You cannot use a rotation grace period.

<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">

<Steps>
Expand Down Expand Up @@ -165,6 +167,32 @@ To revoke the previous secret immediately, omit `previous_client_secret_expires_

</TabItem> </Tabs>

## Recover a leaked service token

Cloudflare can receive service token leak reports from secret scanning partners, such as GitHub. A token reported as leaked cannot be re-enabled until you rotate its secret.

To recover a disabled token after a leak report:

<Steps>
1. [Rotate the token's secret](#rotate-service-token-secrets). In the dashboard, select _Revoke immediately_. In an API rotation request, omit `previous_client_secret_expires_at`.

@jayjesskay jayjesskay Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would update this to: "In the dashboard, select Rotate secret — the current secret is revoked immediately."

There is no 'revoke immediately' option. It looks like:

Image Image

2. Replace the leaked secret in your services with the new Client Secret. The Client ID stays the same.
3. [Turn the token on again](#turn-a-service-token-on-or-off). Rotation does not automatically re-enable a disabled token.
</Steps>

Remove the exposed secret from the location identified in the report. Removing it does not replace rotation: the secret may already have been copied.

The service token API returns these read-only fields when available:

| Field | Description |
| ------------------ | -------------------------------------------------------- |
| `leak_reported_at` | When a secret scanning partner reported the leak. |
| `leak_reporter` | The secret scanning partner that reported the leak. |
| `leak_report_url` | Where the secret was found, if provided by the reporter. |

Rotation clears the token's leak metadata. Review [admin activity logs](/cloudflare-one/insights/logs/dashboard-logs/admin-activity-logs/) for the audit history.

Attempting to re-enable a token before rotation returns `409`. Requesting a future `previous_client_secret_expires_at` when rotating a leaked token returns `400`. The leaked secret is discarded immediately and cannot be restored by extending its expiration.

## Renew service tokens

Service tokens expire according to the token duration you selected when you created the token.
Expand Down
Loading