# Leaked Cloudflare Global API Key? Change It Now > Cloudflare Global API Key exposed on GitHub? Change it in your profile, switch to scoped API tokens and review the audit log. Step-by-step guide. Source: https://leakwatch.net/secrets/cloudflare-global-api-key --- [LeakWatch](/) [Product](/product)[Live feed](/leaks)[Guides](/secrets)[Blog](/blog)[Free scan](/) 1. [Home](/) 2. [Secrets](/secrets) 3. Cloudflare Global API Key Cloud · Secret guide # Leaked Cloudflare Global API Key: what to do in the first hour Critical severityDetected onlyLast verified October 23, 2026 · 5 min read A Cloudflare Global API Key, used together with the account email address, gives full control over every Cloudflare account that user can access. The holder can change DNS records, turn off security features, edit Workers and load balancers, and read or change the settings of every zone on the account. It has no scope, so it cannot be limited to one domain or one product. Change the key first, then find out what was done with it. [Check your GitHub account for leaked secrets — free](/) Provider Cloudflare Severity Critical Impact Cloud infrastructure access Checked live by LeakWatch No ## What a Cloudflare Global API Key looks like Cloudflare issues Global API Keys in two formats. Keys created or rolled recently use a prefixed format: `cfk_`, then 40 characters and a checksum. Older keys are a lowercase hexadecimal string of 37 to 45 characters, which means the characters 0 to 9 and a to f, with no prefix: ```text cfk_…XXXX Global API key, current format (masked) …XXXX Global API key, legacy format (masked, 37 to 45 hexadecimal characters) ``` The `cfk_` prefix identifies the key on its own. The legacy format does not: hexadecimal strings of this length appear in many places, such as hashes and build identifiers, so the value alone does not say much. What identifies it is context. The rule looks for the header name `X-Auth-Key`, or for a variable that names Cloudflare, placed right before the value. The key is usually paired with the account email, which is sent in an `X-Auth-Email` header. An email address on its own is not a secret, but seeing it next to a key is a strong sign that the key is the Global one. ## How Cloudflare Global API Keys get leaked - **Scripts that call the API.** A shell script or a backup job that sends the `X-Auth-Key` header with the key written in, then pushed to a public repository. - **Environment files.** A `CLOUDFLARE_API_KEY` variable in a `.env` file or a deployment configuration that was committed by accident. - **Older tools.** Plugins and integrations from before scoped tokens were common often ask for the Global key, and they store it in a config file that gets shared. - **Pipeline logs.** A verbose request log that prints the headers of a call to the API. - **Support requests and screenshots.** An example request pasted into a forum or a ticket with the header visible. ## What to do in the first hour 1. **Change the Global API Key.** Changing it generates a new value and stops the old one from working straight away. Do this before you investigate, because the old value keeps working until you do. The steps are in the section below. 2. **Deploy the new key** to every place that used the old one. Search your repositories, CI settings and deployment tools for the old value and for the `X-Auth-Key` header. Confirm that each system still works. 3. **Review the audit log.** Cloudflare keeps an audit log of configuration changes for each account. Filter it by the period since the exposure and look for DNS edits, new zones, disabled firewall rules, new members and new API tokens. 4. **Check the members and tokens.** Look at who has access to the account, and at the API tokens it has issued. Delete any token you cannot explain, and remove members you do not recognize. 5. **Check the DNS and certificates.** An attacker who controls DNS can redirect traffic. Compare the records with what you expect, and check that certificates and origin settings are unchanged. 6. **Move to scoped tokens.** Create an API token for each system with only the permissions it needs, and switch the systems over to those tokens. Cloudflare recommends this over the Global key, and it limits the damage of the next leak. 7. **Clean the repository.** Remove the value and rewrite history if you want to. See [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) and [Deep scan your whole git history](/blog/deep-scan-your-whole-git-history). Not sure what else leaked? [Run a free scan](/). [Not sure what else leaked? Run a free scan.](/) ## Revoke it at Cloudflare The Global API Key is changed from the API Keys section of your profile’s API tokens page. Open the API tokens page, find the Global API Key in the API Keys section, and choose the option to change it. Confirming the change produces a new value and invalidates the old one, so there is no separate delete step for this key. You need to have a verified email address on the account before the Global key is available. If the layout differs from this description, look for the API Keys section on the API tokens page, and follow Cloudflare’s documentation for the current steps. ## How LeakWatch detects it The rule is called Cloudflare Global API Key and has two parts. A key in the current format, `cfk_` followed by 40 to 80 letters, digits, underscores or hyphens, is reported wherever it appears, with no context needed. A legacy key needs context: the rule looks for the word `cloudflare` in lower case or upper case, optionally followed by up to 20 letters, digits, dots, underscores or hyphens, or for the header name `X-Auth-Key` in its usual spellings. Either one must sit right before an equals sign or colon, with optional quotes and spaces, and then a value of 37 to 45 lowercase hexadecimal digits. A bare hexadecimal string with no Cloudflare or header context is not reported. The severity is **critical**. This type is not checked live: LeakWatch does not send any request to Cloudflare with the value it found. LeakWatch detects this format but does **not** check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it. ## FAQ Why is the Global key rated critical when the rule is contextual? Because the key has no scope at all. If the rule finds it, the impact is the whole account, so the context needed to report it is deliberately narrow and the severity is high. Do I need to change the email address too? No. The email is only half of the header pair, and it is not a secret. Change the key, and check the account for changes made while it was exposed. Can I just delete the key? You cannot delete the Global key. Changing it is the way to end the exposure, so use that option. Afterwards, switch your systems to scoped API tokens, which you can create, roll and delete one at a time. ## Related - [Cloudflare API Token / Key](/secrets/cloudflare-api-token) - [AWS access key](/secrets/aws-access-key) - [DigitalOcean API Token](/secrets/digitalocean-token) - [I accidentally pushed an API key to GitHub](/blog/i-accidentally-pushed-an-api-key-to-github) - [Which vendors leak most this week](/leaks/trends) - [All secret guides](/secrets) [Get alerted next time a secret leaks — create a free account](/) LeakWatch is not affiliated with Cloudflare. ![Gabriel Diyan, founder of LeakWatch](/brand/Photo-Gabriel-Diyan.webp) Gabriel Diyan (0xCr0c0) Cybersecurity student, founder of LeakWatch. I built and run the scanner described here — the detection patterns, the false-positive classifier and the provider validators are mine. [More about who I am](/about). [GitHub](https://github.com/Leakwatch-Scan) · [X](https://x.com/LeakwatchScan) · [LinkedIn](https://www.linkedin.com/in/gabriel-diyan-80a378375) · [GitHub (personal)](https://github.com/crocogab) LeakWatch Secrets leak into public commits every minute. This watches the forges for yours. Built and run by [Gabriel Diyan](/about), a cybersecurity student — [why LeakWatch exists](/about). Scan - [Product](/product) - [Live feed](/leaks) - [Trends](/leaks/trends) - [API docs](/docs) - [CI/CD](/docs?tab=ci) Read - [Blog](/blog) - [Secret guides](/secrets) - [Changelog](/changelog) - [About](/about) Verify - [Security](/security) - [Privacy](/privacy) - [Terms](/terms) - [Legal](/legal) - [Contact](/contact) - [Status](https://status.leakwatch.net) © 2026 LeakWatch [GitHub](https://github.com/Leakwatch-Scan)[X](https://x.com/LeakwatchScan)