ST-2026-224 · Authentication & identity
Cloudflare Access adds service-token disable and rotation-grace controls
Cloudflare Access added lifecycle controls that let administrators disable a service token without deleting its configuration and choose a bounded rotation grace period in which the old and new secrets can both remain valid before the prior secret expires.
Previous state
Cloudflare's 25 August 2026 changelog entries introduce temporary service-token disablement and configurable rotation grace periods but do not state the previous lifecycle-control behavior.
Current state
Cloudflare Access administrators can disable a service token without deleting it, preventing authentication while disabled, and can rotate service-token secrets with a grace period from one hour to 30 days or revoke the previous secret immediately; both secrets can remain valid during a configured grace period.
Affected users
Who needs to care
Cloudflare Zero Trust administrators and service-to-service workloads that authenticate to Access using service tokens.
Required response
What to do
Review service-token disable and rotation procedures, choose a grace period appropriate to the workload, update consumers to the new secret within that window, and revoke or disable credentials promptly where continued authentication is not intended.
Evidence boundary
What the source does not prove
Cloudflare proves the service-token status and rotation-grace controls. It does not automatically rotate existing tokens, change user identity-provider behavior, or prove that any particular customer has enabled a grace period or disabled a token.
Lifecycle history
Dated event sequence
- Service-token lifecycle controls announced
Cloudflare documented disabled-token authentication behavior and configurable service-token secret-rotation grace periods.
Evidence ledger
First-party sources
- 01Cloudflare — Temporarily disable Access service tokens
Official Cloudflare changelog · 2026-08-25
Open official source ↗ - 02Cloudflare — Service token rotation grace periods
Official Cloudflare changelog · 2026-08-25
Open official source ↗