Non-human identity security: automatic revocation, OAuth, and granular permissions

In an era when agents and scripts use APIs just like humans do, Principal, Credential, and Policy must be managed together. If who the identity is, what token proves it, and how far it's allowed to go are viewed separately, excessive permissions and leak incidents can easily occur.

To address leaked API token incidents, Cloudflare introduced a scannable token format. New tokens use a structure of cfk_, cfut_, cfat_ prefixes plus a 40-character body + checksum, allowing credential scanners like GitHub to identify them with high confidence, and when found in public repositories, they are connected to automatic revocation. Existing tokens continue to work, but newly issued tokens will use this more detectable format.

The scope of protection extends beyond GitHub secret scanning to DLP in Cloudflare One as well. Cloudflare Gateway detects and blocks token leaks in network traffic, Cloudflare Email Security does so in Outlook mail, and Cloudflare CASB does so in SaaS storage such as Google Drive, OneDrive, and Dropbox, while Cloudflare AI Gateway inspects prompts and model responses in real time as well.

The OAuth experience has also been streamlined. Users can now see in one place which third-party application accesses which account with what scopes, and disconnect immediately if needed. Through this, Cloudflare helps apply the principle of least privilege in a practical way.

The permission model has also become more fine-grained. In addition to existing RBAC, resource-scoped permissions have been expanded to Access Applications, Access Identity Providers, Access Policies, Access Service Tokens, and Access Targets, and the API Token creation experience in the Dashboard has also been redesigned. As a result, for both humans and agents, access is limited to only the necessary resources, reducing the attack surface of accounts and infrastructure.