Start free

Providers / Cloudflare

Domains and DNS

Cloudflare domains, keys and logins

What every Cloudflare credential a founder holds does, whether it expires, and what tends to break. Each fact links to Cloudflare's own docs.

Last checked 2026-11-08 · www.cloudflare.com

At a glance

CredentialExpiryPermissions
Cloudflare dashboard loginNot documented–
API token (scoped)You chooseCan be scoped
Global API keyNot documentedFull access only
Origin CA certificate (with private key)Fixed lifetimeFull access only

How to rotate the Cloudflare API token

  1. In the Cloudflare dashboard, go to My Profile > API Tokens Cloudflare docs
  2. Next to the API token you want to roll, select the three dot icon > Roll Cloudflare docs
  3. Select Confirm to generate a new API token, then copy the new value into your secrets vault and deploy it to everything that uses the token Cloudflare docs
  4. Check the new token's status with GET /user/tokens/verify, which returns the token's id, status, expires_on and not_before Cloudflare docs

Can the old and new key work at the same time? Cloudflare's docs don't say. Cloudflare says rolling a token invalidates the previous token and that the new token keeps the same access and permissions. The docs do not say when the old value stops working. If you need an overlap, you could create a second token with the same permissions instead of rolling (our suggestion, not documented).

Revoking the old one: Rolling invalidates the previous token. To remove a token entirely, the API reference (https://developers.cloudflare.com/api/resources/user/subresources/tokens/) lists DELETE /user/tokens/{token_id}; the pages read do not give a dashboard path for deleting.

Source: developers.cloudflare.com/fundamentals/api/how-to/roll-token/, checked

Does the Cloudflare API token expire?

It's up to you: you can set an expiry for the Cloudflare API token.

What breaks when the Cloudflare API token expires

The API reference (https://developers.cloudflare.com/api/resources/user/subresources/tokens/) documents a token status of active, disabled or expired, and the verify endpoint (GET /user/tokens/verify) reports the status. The docs read do not say what error a request made with an expired token returns, so check the status with the verify endpoint and your own logs.

Other things that often go wrong with Cloudflare:

How to rotate the Cloudflare Global API key

  1. In the Cloudflare dashboard, go to My Profile > API Tokens Cloudflare docs
  2. In the API Keys section, select View next to Global API Key. If your API key might be compromised, select Change Cloudflare docs
  3. Update everything that uses the key with the new value (our advice). Cloudflare says new and rolled Global API keys use the cfk_ prefixed scannable format that credential scanning tools can detect Cloudflare docs

Can the old and new key work at the same time? Cloudflare's docs don't say. The docs do not say whether the old key stops working when you change it, or when. Only one Global API key can be provisioned per user, which suggests no second key to switch to, but the page does not state that outcome.

Revoking the old one: The docs do not describe a separate revoke step. Changing the key is the documented response to a possible compromise. Cloudflare also recommends API tokens over the Global API key.

Source: developers.cloudflare.com/fundamentals/api/get-started/keys/, checked

Does the Cloudflare Global API key expire?

Cloudflare's docs don't say whether the Cloudflare Global API key expires.

What breaks when the Cloudflare Global API key expires

The docs do not say whether the Global API key expires, so no expiry behaviour is documented.

How to rotate the Cloudflare Origin CA certificate

  1. Go to the Origin Server page, open the Origin Certificates tab and select Create Certificate Cloudflare docs
  2. Choose Generate private key and CSR with Cloudflare, or Use my private key and CSR, then choose a Certificate Validity period Cloudflare docs
  3. Copy the signed Origin Certificate and Private Key into separate files. You cannot see the private key after you exit this screen Cloudflare docs
  4. Upload the new certificate to your origin web server (some setups also need the Cloudflare CA root certificate), and make sure SSL and port 443 are enabled Cloudflare docs
  5. Once the origin serves the new certificate, go to the Origin Server page, choose the old certificate on the Origin Certificates tab and select Revoke. This cannot be undone Cloudflare docs

Can the old and new key work at the same time? Cloudflare's docs don't say. The docs do not state whether an old origin CA certificate keeps working after a new one is issued. Revoking is a separate step, which suggests the old one stays trusted until revoked or expired, but the page does not say so.

Revoking the old one: On the Origin Server page, Origin Certificates tab, choose the certificate and select Revoke. Cloudflare says you cannot undo this and suggests setting SSL/TLS encryption to Full or Flexible first to avoid visitor warnings. Users without API access get an error when creating or revoking.

Source: developers.cloudflare.com/ssl/origin-configuration/origin-ca/, checked

Does the Cloudflare Origin CA certificate expire?

Yes. The Cloudflare Origin CA certificate has a fixed lifetime set by Cloudflare.

What breaks when the Cloudflare Origin CA certificate expires

The docs do not say what happens when an origin CA certificate expires. Cloudflare says it does not currently send expiration notifications for origin CA certificates and suggests tracking expiry in your own inventory or monitoring. The API reference (https://developers.cloudflare.com/api/resources/origin_ca_certificates/) lists an expires_on field for each certificate.

Each credential

Cloudflare dashboard login

The Global API key and the account owner login together control the whole account.

Cloudflare docs

API token (scoped)

Permissions are set as policies on specific resources. The Token expiration field and client IP filtering restrict use; expiry is optional when creating through the dashboard. The API documents expires_on and not_before in the create and verify responses. Token status can be checked with the verify endpoint, which returns active, disabled or expired. Cloudflare recommends IP filtering or a TTL to limit damage if a token leaks.

Cloudflare docs

Global API key

One key per user with the same permissions as the user across all of the account's resources. It cannot be restricted by IP, time or resource. Cloudflare says to roll it if it might be compromised. Newer keys use the cfk_ prefix. The docs do not say whether it expires. Cloudflare's docs contrast it with API tokens, which can be limited to time windows and expire, implying the Global key has no such limit; no explicit statement that it never expires.

Cloudflare docs

Origin CA certificate (with private key)

Validity is chosen at issuance. The API requested_validity accepts 7, 30, 90, 365, 730, 1095 or 5475 days (15 years maximum); the API reference states no default (5475 appears only in an example). Cloudflare does not currently send expiration notifications for origin CA certificates. Certificates can be revoked from the Origin Server page. RSA or ECC keys.

Cloudflare docs

Renewals and billing

Registrar renewals are at registry cost. Billing API found: /accounts/{id}/billing/profile and /accounts/{id}/billing/spend-policies (balance_cents for the current period, asynchronous estimate, no day or month series). No daily or monthly spend endpoint found; reference page truncated after the Billing Profiles section.

Where to find it in Cloudflare

What Cloudflare's docs don't say

We couldn't confirm these from official docs, so don't rely on them either way:

Rotating or replacing a Cloudflare key

The steps are the same for most providers: make the new key, deploy it everywhere the old one is used, check it works, then revoke the old one. Our guides walk through it:

Rotate an API keyWithout downtime, in the right order. A key leakedWhat to do in the first hour.

Sources

Related providers

GoDaddyDomains and DNS NamecheapDomains and DNS PorkbunDomains and DNS

Keep track of every Cloudflare key

StackHangar stores your Cloudflare keys in an encrypted vault, grouped by the product they belong to, warns you before they expire, and walks you through rotating them. We can't read your secrets.

Start free with 2 projectsHow the vault works