Leaked Cloudflare API Token / Key: what to do in the first hour

• Infrastructure as code. A token in a Terraform provider block, a Pulumi config or an Ansible variable file.
• DNS automation. ACME clients, dynamic-DNS scripts and certificate tools keep a token in a config file to prove domain ownership.
• Worker and CI configuration. A wrangler environment file or a deployment workflow that exposes the token to the build.
• Shell history and curl examples. Commands with X-Auth-Key or an Authorization header pasted into issues, wikis and chat.
• Dotfiles and backups. A home directory or server backup published with its configuration.

1. Identify what leaked. A scoped API token, the Global API Key and an Origin CA key are rotated in different places. Check the variable name and header around the value in the file you found: Bearer means a scoped token, X-Auth-Key means the Global API Key.
2. Roll or delete it. In the Cloudflare dashboard open My Profile → API Tokens. For a scoped token, use Roll to issue a new secret or delete the token. For the Global API Key, use the API Keys section to roll it, since viewing it requires your password.
3. Replace it with a narrow token. Create a new API token limited to one permission group and one zone, ideally with an IP restriction and an expiry. Do not create another Global API Key.
4. Review DNS. Compare every record in every zone with your expectations. Look for changed A, AAAA and CNAME targets, new MX and TXT records (email hijack and domain verification), and records that point at addresses you do not own.
5. Review rules, Workers and access. Check redirect and transform rules, Page Rules, Workers routes and scripts, firewall rules, and Zero Trust settings. Look at the account’s members, other API tokens and recent logins.
6. Read the audit log. In the account’s audit log filter by the period since the exposure and look for actions made with an API token or key.

Not sure what else leaked? Run a free scan.

7. Then clean the repository: remove the value and rewrite history if you want to. See I accidentally pushed an API key to GitHub.

If the account supports it, enable two-factor authentication, since rolling the Global API Key does nothing about a stolen password.

Sign in to the Cloudflare dashboard, open your profile menu and choose My Profile, then API Tokens. Scoped tokens are listed there with their permissions and expiry; roll the exposed one, which gives it a new secret and invalidates the old, or delete it. The Global API Key appears in the same page’s keys section behind a View action that asks for your password, and it can be rolled there. Origin CA keys have their own entry in that section. Tokens are tied to the user who created them, so a colleague’s token must be rolled from their own account.

This type is matched by context, not by a prefix. The Cloudflare API Key rule looks for the word “cloudflare” near an assignment and then a 40-character value, while a companion rule looks for a 37-character hexadecimal key next to “cloudflare” or the X-Auth-Key header. That makes it good at catching a credential in a config file and blind to one stored under a generic name such as API_KEY with no Cloudflare mention. LeakWatch detects this format but does not check it live: it can tell you the credential is exposed, not whether it still works. Assume it does until you have revoked it.