Vendor claim: Cloudflare announced that you can now create app‑scoped API tokens for Flagship, which restrict access to selected apps only.
What are app‑scoped tokens?
App‑scoped tokens are custom API tokens that limit permissions to a specific Flagship app. When creating a token, the resource dropdown defaults to Entire Account; switching it to Specified Flagship apps lets you pick the target app and assign one of three permissions: Evaluate, Read, or Write.
When to use them
These tokens are intended for trusted server‑side environments—such as Cloudflare Wrangler, CI pipelines, or backend services—that only need to interact with a single Flagship app. They reduce the risk of over‑privileged credentials compared to account‑wide tokens.
How to create an app‑scoped token
Follow Cloudflare’s standard token creation flow, then select Specified Flagship apps in the resource dropdown and choose the desired app and permission level. For detailed steps, see the official documentation.
Limitations
Account‑wide Flagship permissions (Evaluate, Read, Write) remain available for scenarios that require access to all apps. App‑scoped tokens cannot be used for actions outside the Flagship API surface.
Overall, this feature offers a more granular security model for developers building on Flagship, aligning with the principle of least privilege.