Cloudflare API token

ID cloudflare_api_token

DatatypeNot PIIidentifierDraft

This record is a draft: it has not been reviewed yet and may be incomplete or wrong. Do not rely on it for compliance decisions. Help improve it (see CONTRIBUTING.md).

Scoped API token of Cloudflare. Tokens created or rolled in the scannable format start with cfut_ (user API token) or cfat_ (account API token), followed by 40 characters and a checksum whose length Cloudflare does not state. Older tokens are unprefixed 40-character strings; they keep working but are too generic for a regexp and are not covered.

Parent datatype: Access token access_token
Categories: Secrets and credentials (passwords, keys, tokens)
Countries: Global (not tied to a country)
Languages: Common to most languages
Quality: 70/100 · missing: examples, mapping (Wikidata, Schema.org, ...), translation
Metacrafter rules: no detection rule yet
Supported by tools: Cloudflare DLP, Datadog Sensitive Data Scanner, GitGuardian, GitHub secret scanning

Regular expression

^cf(?:ut|at)_[A-Za-z0-9]{41,}$

Python re syntax.

Examples

Value	Description
cfut_ invalid	Prefix without the token

Sources

doc: https://developers.cloudflare.com/fundamentals/api/get-started/token-formats/

Use this record

Page URL: https://registry.apicrafter.io/datatype/cloudflare_api_token
JSON: API v1 · legacy shape (used by metacrafter) · Markdown (for LLMs)
Improve it: edit data/datatypes/any/secrets/cloudflare_api_token.yaml on GitHub