API Reference

Zero Trust

Access

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Service Tokens

List service tokens

GET/{accounts_or_zones}/{account_or_zone_id}/access/service_tokens

Get a service token

GET/{accounts_or_zones}/{account_or_zone_id}/access/service_tokens/{service_token_id}

Create a service token

POST/{accounts_or_zones}/{account_or_zone_id}/access/service_tokens

Update a service token

PUT/{accounts_or_zones}/{account_or_zone_id}/access/service_tokens/{service_token_id}

Delete a service token

DELETE/{accounts_or_zones}/{account_or_zone_id}/access/service_tokens/{service_token_id}

Refresh a service token

POST/accounts/{account_id}/access/service_tokens/{service_token_id}/refresh

Rotate a service token

POST/accounts/{account_id}/access/service_tokens/{service_token_id}/rotate

ModelsExpand Collapse

ServiceToken { id, client_id, duration, 2 more }

id: optional string

The ID of the service token.

maxLength36

client_id: optional string

The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header.

duration: optional string

The duration for how long the service token will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).

expires_at: optional string

formatdate-time

name: optional string

The name of the service token.

ServiceTokenCreateResponse { id, client_id, client_secret, 2 more }

id: optional string

The ID of the service token.

client_id: optional string

The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header.

client_secret: optional string

The Client Secret for the service token. Access will check for this value in the CF-Access-Client-Secret request header.

duration: optional string

The duration for how long the service token will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).

name: optional string

The name of the service token.

ServiceTokenRotateResponse { id, client_id, client_secret, 2 more }

id: optional string

The ID of the service token.

client_id: optional string

The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header.

client_secret: optional string

The Client Secret for the service token. Access will check for this value in the CF-Access-Client-Secret request header.

duration: optional string

The duration for how long the service token will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h. The default is 1 year in hours (8760h).

name: optional string

The name of the service token.