A Cloudflare Global API Key, used together with the account email address, gives full control over every Cloudflare account that user can access. The holder can change DNS records, turn off security features, edit Workers and load balancers, and read or change the settings of every zone on the account. It has no scope, so it cannot be limited to one domain or one product. Change the key first, then find out what was done with it.
Check your GitHub account for leaked secrets — free
- Provider
- Cloudflare
- Severity
- Critical
- Impact
- Cloud infrastructure access
- Checked live by LeakWatch
- No
What a Cloudflare Global API Key looks like
Cloudflare issues Global API Keys in two formats. Keys created or rolled recently use a prefixed format: cfk_, then 40 characters and a checksum. Older keys are a lowercase hexadecimal string of 37 to 45 characters, which means the characters 0 to 9 and a to f, with no prefix:
cfk_…XXXX Global API key, current format (masked)
…XXXX Global API key, legacy format (masked, 37 to 45 hexadecimal characters)
The cfk_ prefix identifies the key on its own. The legacy format does not:
hexadecimal strings of this length appear in many places, such as hashes and build identifiers, so the value alone does not say much. What identifies it is context. The rule looks for the header name X-Auth-Key, or for a variable that names Cloudflare, placed right before the value. The key is usually paired with the account email, which is sent in an X-Auth-Email header. An email address on its own is not a secret, but seeing it next to a key is a strong sign that the key is the Global one.
How Cloudflare Global API Keys get leaked
- Scripts that call the API. A shell script or a backup job that sends the
X-Auth-Keyheader with the key written in, then pushed to a public repository. - Environment files. A
CLOUDFLARE_API_KEYvariable in a.envfile or a deployment configuration that was committed by accident. - Older tools. Plugins and integrations from before scoped tokens were common often ask for the Global key, and they store it in a config file that gets shared.
- Pipeline logs. A verbose request log that prints the headers of a call to the API.
- Support requests and screenshots. An example request pasted into a forum or a ticket with the header visible.
What to do in the first hour
- Change the Global API Key. Changing it generates a new value and stops the old one from working straight away. Do this before you investigate, because the old value keeps working until you do. The steps are in the section below.
- Deploy the new key to every place that used the old one. Search your repositories, CI settings and deployment tools for the old value and for the
X-Auth-Keyheader. Confirm that each system still works. - Review the audit log. Cloudflare keeps an audit log of configuration changes for each account. Filter it by the period since the exposure and look for DNS edits, new zones, disabled firewall rules, new members and new API tokens.
- Check the members and tokens. Look at who has access to the account, and at the API tokens it has issued. Delete any token you cannot explain, and remove members you do not recognize.
- Check the DNS and certificates. An attacker who controls DNS can redirect traffic. Compare the records with what you expect, and check that certificates and origin settings are unchanged.
- Move to scoped tokens. Create an API token for each system with only the permissions it needs, and switch the systems over to those tokens. Cloudflare recommends this over the Global key, and it limits the damage of the next leak.
- Clean the repository. Remove the value and rewrite history if you want to. See I accidentally pushed an API key to GitHub and Deep scan your whole git history.
Not sure what else leaked? Run a free scan.
Revoke it at Cloudflare
The Global API Key is changed from the API Keys section of your profile’s API tokens page. Open the API tokens page, find the Global API Key in the API Keys section, and choose the option to change it. Confirming the change produces a new value and invalidates the old one, so there is no separate delete step for this key. You need to have a verified email address on the account before the Global key is available. If the layout differs from this description, look for the API Keys section on the API tokens page, and follow Cloudflare’s documentation for the current steps.
How LeakWatch detects it
The rule is called Cloudflare Global API Key and has two parts. A key in the current format, cfk_ followed by 40 to 80 letters, digits, underscores or hyphens, is reported wherever it appears, with no context needed. A legacy key needs context: the rule looks for the word cloudflare in lower case or upper case, optionally followed by up to 20 letters, digits, dots, underscores or hyphens, or for the header name X-Auth-Key in its usual spellings. Either one must sit right before an equals sign or colon, with optional quotes and spaces, and then a value of 37 to 45 lowercase hexadecimal digits. A bare hexadecimal string with no Cloudflare or header context is not reported. The severity is critical. This type is not checked live: LeakWatch does not send any request to Cloudflare with the value it found.
LeakWatch detects this format but does not check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it.
FAQ
Why is the Global key rated critical when the rule is contextual?
Because the key has no scope at all. If the rule finds it, the impact is the whole account, so the context needed to report it is deliberately narrow and the severity is high.
Do I need to change the email address too?
No. The email is only half of the header pair, and it is not a secret. Change the key, and check the account for changes made while it was exposed.
Can I just delete the key?
You cannot delete the Global key. Changing it is the way to end the exposure, so use that option. Afterwards, switch your systems to scoped API tokens, which you can create, roll and delete one at a time.