What’s New?
On August 25 2026 Cloudflare announced that Access administrators can temporarily turn off service tokens while keeping the token configuration intact. A disabled token cannot authenticate, and any secret that was in a rotation grace period is also stopped.
Why Use This Control?
- Contain a suspected credential leak without losing the token setup.
- Pause an automated service while you investigate or perform maintenance.
- Retain all token settings so you can re‑enable it later with a single action.
How to Turn a Service Token On or Off
Cloudflare provides a dedicated UI flow for toggling the token status. For step‑by‑step instructions, see the official documentation: Turn a service token on or off.
Key Points to Remember
- Disabling a token does not delete it; the configuration remains available.
- When a token is disabled, any secret that was still valid during a rotation grace period is immediately invalidated.
- You can re‑enable the token at any time, restoring its previous authentication capability.
Best Practices
- Investigate before disabling: Verify that the token is the source of the suspected exposure.
- Document the change: Record why the token was disabled and who performed the action.
- Re‑enable promptly: Once the issue is resolved, turn the token back on to avoid service disruption.
By using this new control, organizations can react quickly to credential‑related incidents while preserving the operational setup of their automated services.