token-formats.mdx

title	Token formats
pcx_content_type	concept
sidebar	order 5
description	Scannable API credential formats and leaked token detection.

Cloudflare API credentials use a prefixed, scannable format that makes them identifiable by credential scanning tools. Each credential type has a distinct prefix followed by 40 characters and a checksum.

Credential type	Description	Format
Global API Key	Global key tied to your user account (full access)	cfk_[40 characters][checksum]
User API Token	Scoped token you create for specific permissions	cfut_[40 characters][checksum]
Account API Token	Token owned by the account, not tied to a specific user	cfat_[40 characters][checksum]

Existing tokens continue to work. Every new token you create or roll uses the scannable format automatically.

Leaked token detection

The prefixed format and checksum allow credential scanning tools to detect leaked Cloudflare tokens with high confidence. Cloudflare partners with credential scanning providers to proactively find your leaked tokens and revoke them before they can be used maliciously.

GitHub Secret Scanning

Cloudflare participates in GitHub's Secret Scanning program. GitHub scans every commit for Cloudflare API credentials in both public and private repositories.

• Public repositories — When GitHub detects a leaked Cloudflare token, it verifies the token using the checksum and sends Cloudflare a webhook. Cloudflare automatically revokes the token and notifies you by email so you can generate a replacement.
• Private repositories — GitHub notifies you about any leaked Cloudflare tokens so you can rotate them.

Pre-2026 formats

Tokens created before the scannable format was introduced use unprefixed strings. These tokens continue to work. Cloudflare scans for and revokes leaked tokens in both the old and new formats.

Credential type	Old format
Global API Key	37–45 character lowercase hex string
User API Token	40-character alphanumeric string
Account API Token	40-character alphanumeric string