New strict service token authentication setting for Access
The strict service token authentication setting applies consistent behavior to requests made with service tokens. When the setting is on for a Zero Trust organization, Access handles requests with service token headers as follows:
- If authentication or authorization fails, Access always returns
401or403instead of redirecting the client to the login page with302. - Only Service Auth policies can authorize the request. Access ignores Allow policies and any
CF_Authorizationcookie sent with the request. - Access does not return a
CF_Authorizationcookie to the client after successful authentication. Subsequent requests should continue to use service token headers. - Failed requests for recognized service tokens appear in Access authentication logs.
Zero Trust organizations created on or after October 5, 2026 have strict service token authentication turned on by default and cannot turn it off. Cloudflare recommends that existing organizations turn it on as well.
Organizations created before October 5, 2026 can configure the setting in the dashboard or through the API.
-
In the Cloudflare dashboard ↗︎, go to Zero Trust > Access controls > Access settings.
Go to Access settings ↗ -
Under Manage service tokens, turn on Strict service token authentication.
-
In the confirmation dialog, select Enable.
To turn off strict service token authentication, turn off the setting and select Disable.
curl "https://api.cloudflare.com/client/v4/accounts/%7Baccount_id%7D/access/organizations" \
--request PATCH \
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
--json '{
"strict_service_token_auth": true
}'To turn off strict service token authentication, set strict_service_token_auth to false.
For behavior and configuration details, refer to Strict service token authentication.
